themeatelier CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM themeatelier CVE published 2026-07-17

CVE-2026-15759

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbit [truncated]

HIGH themeatelier CVE published 2026-07-10

CVE-2026-15291

The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure, allowing unauthenticated attackers to extract sensitive data. This CVE record was published on 2026-07-10T05:16:32.430Z. The vulnerability exists in all versions up to, and including, 3.1.3 via REST API endpoints. Affected users should update the plugin and review security measures.