Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

Summary

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires no user interaction beyond page load, as setting auto_open and consent_enabled to 'yes' in the injected data-box JSON causes the consent box — and the embedded script — to execute immediately on page load.

Timeline

1. Sep 5, 2026, 5:30 AM UTCCVE published
2. Sep 7, 2026, 11:07 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 7, 2026, 11:17 AM UTCRecord last updated

Affected versions

• quadlayers Social Chat – Click To Chat App Button

  through 8.6.2

References 7