Freshchat

Freshchat has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Freshchat has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Nabil Irawan. Freshchat is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.8.15.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Freshchat vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-64240

Freshchat <= 2.3.4 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Plugin Profile
Latestv2.3.4
2.9(9)
58/100
Last Updated
2021-12-27 (5y ago)
Active Installs
1,000+
Downloads
48,544
Requires WP
3.0.1+
Requires PHP
5.2.4+
Tested up to
WP 5.8.15
Created
2017-09-26 (9y ago)

Speak to all your WordPress site visitors and users to increase sales, collect feedback and provide support. For setup instructions, go here. Modern messaging software that your sales and customer engagement teams will love. 1.Not your typical bot. Meet your new sales sidekick. Engage proactively with those who matter with contextual and timely messages. Let the bot kick in to capture leads, validate and qualify responses, and auto-upload them into your CRM. Customize bot messages to set the right expectations. 2.Get all the context you need to sell smarter With events timeline, user information, and social profiles, know who you’re talking to and what they are up to. Bring in information from external tools like CRM or order management systems for more context. 3.Reduce churn, increase adoption Talk to your users before it’s too late. Set up in-app campaigns to onboard and educate new users, or retain and re-engage lapsing customers. Send announcements, get feedback, and share product best practices right inside the product to close the loop effectively and maximize impact. Paste below snippet with your token in snippet textbox &#8216;<script> window.fcSettings = { token: “XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX”, host: “https://wchat.freshchat.com” }; </script> <script src=”https://wchat.freshchat.com/js/widget.js” async></script>’

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C