Add Chat App Button
Add Chat App Button has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Add Chat App Button has a vendor fix available, so running the current release closes it.
All of these findings were reported by UKO. Add Chat App Button is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-52489Add Chat App Button <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Add Chat App Button
Author
udidol
The Add Chat App Button plugin enables adding a customizable click-to-chat WhatsApp button. The plugin lets you choose between a simple WhatsApp icon and a rectangle with a custom text label (see screenshots). Usage To enable the WhatsApp button, check the first checkbox in the settings page. You will find the settings page in the admin dashboard menu, under Settings->Add Chat App Button. You must enter an international phone number (only numbers, NO plus sign (+), NO dashes(-)) in order to enable the WhatsApp button. Even if you manage to save settings into the database without entering a phone number, your button might not work properly. The plugin settings page has two tabs: “General Settings” and “Button Design”. The General Settings tab includes options such as limiting the button to only display under a certain screen resolution (in pixels), attaching a default message that will be populated in the user’s phone when they click the button, and more. The Button Design tab includes controls for the button color, label text color, button type (side-bearing rectangle, WhatsApp icon, fixed-bottom button), and more. The Button Design tab also includes a smartphone mockup with a live preview screen, enabling you to see a real-time (estimated) rendering of how your button would look, on the fly, as you are changing its design. The plugin detects whether the site visitor is using a desktop or mobile device and serves a different link for each accordingly.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C