Click to Chat – HoliThemes

Click to Chat – HoliThemes has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 5 are fixed as of October 2026. Their average CVSS score is 7.4, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Code Injection, PHP Remote File Inclusion.

Every one of the 5 issues recorded for Click to Chat – HoliThemes has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Click to Chat – HoliThemes vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2026-92097

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

Read the full analysis

Vulnerability Records

5 records


2026-10-13 12:25	Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder Click to Chat <= 4.44	`CVE-2026-92097`	9.1 Critical	Kuba	Yes
2026-06-05 13:37	Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter Click to Chat <= 4.39	`CVE-2026-7795`	6.4 Medium	Vijay	Yes
2025-06-13 20:15	Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter Click to Chat <= 4.22	`CVE-2025-5336`	6.4 Medium	Asaf Mozes	Yes
2024-04-17 00:00	Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion Click to Chat <= 3.35	`CVE-2024-3849`	8.8 High	haidv35	Yes
2022-12-21 00:00	Click to Chat <= 3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Click to Chat <= 3.18	`CVE-2022-4480`	6.4 Medium	István Márton	Yes

Showing 1–5 of 5 reports