Wawp Country Code & Chat Widget for WooCommerce

Wawp Country Code & Chat Widget for WooCommerce has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 0 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Improper Privilege Management, Weak Password Recovery Mechanism For Forgotten Password.

Every one of the 4 issues recorded for Wawp Country Code & Chat Widget for WooCommerce has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Wawp Country Code & Chat Widget for WooCommerce is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
8.7/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all Wawp Country Code & Chat Widget for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-14281

Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

Read the full analysis

Vulnerability Records

4 records
Wawp Country Code & Chat Widget for WooCommerce banner
Latestv5.1.0

Wawp Country Code & Chat Widget for WooCommerce

Information Technology

Author

Information Technology

0.0(0)
0/100
Last Updated
2026-10-07 (21d ago)
Active Installs
400+
Downloads
34,364
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2023-04-11 (4y ago)

Wawp Country Code & Chat Widget for WooCommerce provides a practical solution to add country flags, dial codes, and phone number validation to your WooCommerce checkout and forms. Help customers enter valid phone numbers with an interactive phone input field featuring national flags, automatic country detection by IP, and standardized international formatting. 🌟 Key Features 🌍 Country Code & Phone Validation Interactive Country Flag Dropdown: International telephone input with country flags and dial codes. Auto-Detection: Automatically detect the customer’s country via IP or WooCommerce billing country to pre-select the dial code. WooCommerce Checkout Integration: Attaches to the Billing and Shipping Phone fields in Classic and WooCommerce Block checkouts. Standardized Formatting: Formats phone numbers using libphonenumber standards (E.164 and National formats). Phone Validation: Verifies phone number length and structure before submission. Country Filtering: Restrict or configure dropdown lists to display only the countries your store ships to. Custom Field Selectors: Bind international phone input to any custom CSS selector on your site. RTL & LTR Support: Responsive design with support for both Right-to-Left and Left-to-Right languages. 💬 Floating Chat Widget Multi-Agent Support: Assign contact cards for Support, Sales, or Billing lines. Custom Avatars & Starting Messages: Set individual agent names, roles, avatars, and customized starting messages. Social Channels: Connect your Facebook, Instagram, Telegram, TikTok, LinkedIn, and YouTube profiles inside the widget. QR Code Scanner: QR code mapping for desktop traffic to scan with their phone and chat directly. Display Conditions: Control widget visibility based on device type (Desktop/Mobile) or targeted site pages. Local Engagement Analytics: Track impressions, widget opens, agent clicks, and social clicks locally without third-party tracking. Fast & Optimized: Clean code structure without redundant dependencies. WAWP Ecosystem Integration: Connect with the WAWP Platform for order notifications, OTP verification, and marketing automations. Wawp PRO Features Optionally upgrade to access additional workflow tools on Wawp.net: Automated Order Notifications: Send order updates for WooCommerce orders (New Order, Processing, Completed, Shipping updates, and custom statuses). Abandoned Cart Recovery: Send follow-up reminders to customers who leave checkout early. Bulk Campaigns & Broadcasts: Send updates to your customer list with rate-limit protection. Cloud API Integration: Connect to official cloud business messaging gateways. SMS Integration: Backup authentication channel utilizing phone tokens for OTP delivery. Custom Order Statuses: Manage and customize WooCommerce order statuses. Multilingual Notifications: Route notifications based on the customer’s selected checkout language. Message Assistant: Template drafting and translation assistance. HTML Email Templates: Custom transactional email templates to match your store branding. 👉 Check Out Our Pro Plans & Pricing External Services This plugin provides interactive communication tools and direct chat redirection: 1. WhatsApp (Direct Chat Interaction) Service: WhatsApp Public Web & App URLs (api.whatsapp.com / web.whatsapp.com) Purpose: Enables the Chat Widget to redirect users to chat with your designated numbers upon user click. Data Sent: Recipient phone number and optional pre-filled message text. No data is sent automatically; redirection happens only upon direct user click. Consent: Granted when a visitor clicks the chat button. Policies: WhatsApp Terms of Service | WhatsApp Privacy Policy 2. Geolocation & Privacy Local Processing: Geolocation is handled locally; no external IP-lookup services are contacted by this plugin. Privacy: This plugin does not track user behavior or send store data to external servers. Dashboard Analytics: Statistics (widget impressions, clicks) are stored locally in your site’s database. Assets: Core CSS, JS, and icon assets are bundled locally. Source Code & Build Tools This plugin uses modern open-source development tools (React, Vite, NPM, Composer) to build the administrative dashboard and handle libraries. To comply with WordPress.org guidelines regarding human-readable code: Dashboard Source Code (Included in Package): The complete, non-minified, human-readable source code for the administrative React dashboard is included directly within this plugin package under the app/src/ directory: – Main Application Entry: app/src/main.tsx and app/src/App.tsx – React Components & UI: app/src/components/ (including PhoneFieldSettings.tsx, ChatWidgetSettings.tsx, and Radix UI integrations) – State Management & Hooks: app/src/hooks/ and app/src/lib/ – Build Configurations: app/package.json, app/vite.config.ts, app/tsconfig.json – Build Instructions: To compile the distribution assets in app/dist/, navigate to app/ and run: npm install npm run build PHP Dependencies & Composer: – Composer Configuration: composer.json is included in the root directory specifying all project dependencies. Third-Party Libraries & Public Repositories: The following third-party libraries are included in compiled/minified form for runtime efficiency; their full uncompressed source code is publicly accessible at: – intl-tel-input & utils.js: intl-tel-input GitHub Repository (Used for assets/js/resources/intlTelInput.min.js and assets/js/resources/utils.js) – libphonenumber-for-php: libphonenumber-for-php GitHub Repository (Used in vendor/giggsey/libphonenumber-for-php/) – QRCode.js: qrcodejs GitHub Repository (Used for assets/js/resources/qrcode.js)

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C