Threats tagged 'ghsa-5647-98qw-xpgp'

The Joinchat – Enhanced "click to chat" plugin for WordPress versions up to and including 6.3.1 is vulnerable to reflected cross-site scripting (XSS) via the '{HREF}' dynamic variable in query parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content. Exploitation requires prior configuration of a telephone number and inclusion of the {HREF} variable in the Call-to-Action text.