Xelion Webchat

Xelion Webchat has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Improper Privilege Management, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for Xelion Webchat has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Xelion Webchat is installed on roughly 90 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Xelion Webchat vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-3058

Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update

Read the full analysis

Vulnerability Records

2 records
Xelion Webchat banner
Latestv9.8.0

Xelion Webchat

Jauhari Xelion

Author

Jauhari Xelion

5.0(1)
100/100
Last Updated
2026-07-16 (2mo ago)
Active Installs
90+
Downloads
3,079
Requires WP
0+
Requires PHP
7.0+
Tested up to
WP 7.0.4
Created
2023-03-30 (4y ago)

This plugin uses the Xelion platform – you need to be a Xelion customer already. For all of you who already use the Xelion platform, this plugin adds a webchat widget to your WordPress sites that allows you to use Xelion to handle chat contact with all your website visitors. The chat messages are processed through the Xelion application, which allows them to be accessed seamlessly by all relevant people regardless of whether they work on a PC or a smartphone. If you use Xelion and want to use this plugin, you will need these things: Admin privileges for the website that will use this plugin. Admin privileges for your organization’s Xelion installation (the ‘tenant’). API access credentials. Here is what you need to do: Fill in the API settings fields in the plugin. If API settings are correct, you’ll see a success message. If API settings are incorrect, you’ll see an error message. Customize the features to match your preferences. Customize the look and feel to match your brand. When everything is set up, the webchat widget will automatically be on every page of your website. If you run into problems: Contact your Xelion partner or reseller for assistance. Curious about Xelion? To get information about the Xelion platform and to learn if it is a good fit for your organization you can visit our website: https://xelion.com, or you can email us directly at: info@xelion.com.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C