PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92998 Click n Chat CVE debrief

The Click n Chat WordPress plugin, versions 1.0.4 to 1.1.2, is vulnerable to unauthenticated SQL injection attacks through the 'sort_by' and 'sort_order' parameters. This vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or other security issues. Defenders should assess exposure and prioritize patching or mitigation, especially for systems using affected plugin versions. The vulnerability's impact includes potential data breaches, service disruption, and the need for verification of affected systems and plugin versions. Additional information from other sources may be necessary to fully assess the vulnerability. The CVE record and NVD

Vendor
Click n Chat
Product
Chat Widget Integration
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for WordPress installations using the Click n Chat plugin, especially those using versions 1.0.4 to 1.1.2, should assess exposure and prioritize patching or mitigation.

Why it matters

The Click n Chat WordPress plugin vulnerability allows unauthenticated SQL injection, potentially leading to data breaches or service disruption. Defenders should prioritize patching or mitigation, especially for systems using affected plugin versions.

  • Potential data breaches due to successful SQL injection attacks
  • Possible disruption of service or data integrity
  • Need for verification of affected systems and plugin versions
  • Potential for attackers to inject malicious SQL code

Technical summary

The Click n Chat WordPress plugin before version 1.1.3 does not sanitize sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks. This issue affects versions from 1.0.4 up to 1.1.2. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or other security issues. Defenders should prioritize patching or mitigating this vulnerability, especially for systems using the affected plugin versions. The vulnerability's impact includes potential data

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems using the affected plugin versions.

Recommended defensive actions

  • Patch or update the Click n Chat plugin to version 1.1.3 or later
  • Implement additional security measures to detect and prevent SQL injection attacks
  • Monitor systems using the affected plugin versions for potential security incidents

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and affected versions. However, additional information from other sources may be necessary to fully assess the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92998 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92998

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92998 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92998

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.