CVE-2025-5336

Published
View on NVD ↗
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

<p>WhatsApp Chat. Let&#8217;s make your Web page visitors contact you through &#8220;WhatsApp&#8221; or &#8220;WhatsApp Business&#8221; with a single click (WhatsApp Chat, Group).</p> <p><a href="https://holithemes.com/plugins/click-to-chat/" rel="nofollow ugc">Home</a> | <a href="https://holithemes.com/plugins/click-to-chat/list-of-styles/" rel="nofollow ugc">Demo</a> | <a href="https://holithemes.com/plugins/click-to-chat/docs/" rel="nofollow ugc">Documentation</a> | <a href="https://holithemes.com/plugins/click-to-chat/support/" rel="nofollow ugc">Support</a> | <a href="https://holithemes.com/plugins/click-to-chat/pricing/" rel="nofollow ugc">PRO</a></p> <h3>WhatsApp Chat</h3> <p>Add &#8216;WhatsApp&#8217; or &#8216;WhatsApp Business&#8217; Number and let your website visitors contact you with a single click.</p> <p><strong>📱 Mobile:</strong> Open the WhatsApp Mobile App for a seamless connection.</p> <p><strong>💻 Desktop:</strong> Direct visitors to the WhatsApp Desktop App or Web WhatsApp page (web.whatsapp.com)</p> <p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/O_BF9rhazvI?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p> <h3>💎 Styles</h3> <p>Select a style that complements the design of your website.</p> <ul> <li>8 pre-defined customizable styles/designs</li> <li>Add your own Image/GIF</li> <li>Custom Element/Design (convert any element to a WhatsApp Chat element)</li> <li>Shortcodes (Add WhatsApp button/icon with inline the content)</li> <li>Different Styles, Positions for Mobile, Desktop</li> <li>Choose a style and customize it to match the website&#8217;s design</li> </ul> <p><a href="https://holithemes.com/plugins/click-to-chat/list-of-styles/" rel="nofollow ugc">list of Styles</a> | 🎨<a href="https://holithemes.com/plugins/click-to-chat/customize-styles/" rel="nofollow ugc">Customize Styles</a></p> <h4>💡 Add Own Image</h4> <p>Instead of selecting a pre-defined style, add any Image/Animated-image/GIF.</p> <h3>🌈 Custom Element</h3> <p>Convert any Element as a WhatsApp Chat Element by adding</p> <ul> <li>Class/ID name: &#8216;ctc_chat&#8217; (or)</li> <li>Href/link: &#8216;#ctc_chat&#8217;</li> </ul> <p>The custom design element will navigate to WhatsApp based on plugin settings (WhatsApp Number, pre-filled message, Analytics, &#8230;. ).<br /> (e.g. menu item, button, image, link &#8211; just add ctc_chat as a class name)</p> <p><a href="https://holithemes.com/plugins/click-to-chat/custom-element/" rel="nofollow ugc">Custom Element</a></p> <h3>🎉 Greetings Dialog</h3> <p>Add customizable greeting dialogs for boosting user attention and increasing interaction. Seamlessly integrate these greetings into your website for better engagement.</p> <ul> <li><a href="https://holithemes.com/plugins/click-to-chat/greetings-1/" rel="nofollow ugc">Greetings-1</a> &#8211; Customizable Design: Personalize the design to match your branding with full control over fonts, colors, images, and more.</li> <li><a href="https://holithemes.com/plugins/click-to-chat/greetings-2/" rel="nofollow ugc">Greetings-2</a> &#8211; Content Specific: Deliver focused messages that resonate effectively with your users.</li> </ul> <h4>📝 Form Filling</h4> <p>Get the necessary information from the website visitors before initiating the chat.</p> <ul> <li>Get an email notification when the user fills out the form.</li> <li>Call a webhook with the form data to integrate with other applications. Using integrations tools add data in Google Sheet, CRM and many more applications.</li> <li>Form data can be prefilled in the WhatsApp chat window.</li> </ul> <p>PRO: <a href="https://holithemes.com/plugins/click-to-chat/greetings-form/" rel="nofollow ugc">Greetings-Form</a></p> <h4>👥 Multi-Agent</h4> <p>Add multiple WhatsApp chat accounts within a single Greetings dialog.</p> <ul> <li>We can set different time ranges for each agent. (24&#215;7 or multiple time ranges for each day of the week).</li> <li>Offline Agents <ul> <li>Chat when offline (display agent with next available time).</li> <li>Disable chat (display agent with next available time).</li> <li>Hide offline agents</li> </ul> </li> </ul> <p>PRO: <a href="https://holithemes.com/plugins/click-to-chat/multi-agent" rel="nofollow ugc">Multi-Agent</a></p> <h4>⌛ Greetings Actions</h4> <ul> <li><strong>Click Action</strong>: Displays greeting dialog when a user clicks on any element with the class name: ‘ctc_greetings’.</li> <li><strong>ViewPort Action</strong>: Displays Greetings When an element is in/reached viewport(25% margin) with the Class name: &#8216;ctc_greetings_now&#8217; [PRO]</li> <li><strong>Time, Scroll Actions</strong>: Display Greetings based on time, scroll [PRO]</li> </ul> <p>These actions enhance user interaction by triggering greetings at the right moments, improving engagement and support efficiency.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/greetings-actions/" rel="nofollow ugc">Actions</a></p> <h3>🔴 Notification Badge</h3> <p>Get user attention by displaying a notification badge on the WhatsApp Chat element.</p> <p>Customize the notification badge with the notification count, text color, background color, border color, and time delay to display the notification badge.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/notification-badge/" rel="nofollow ugc">Notification Badge</a></p> <h3>✳️ Position to Place</h3> <ul> <li>Add WhatsApp at any position of the screen<br /> (not limited to fixed positions).</li> <li>Different positions for Mobile and Desktop.</li> </ul> <h3>⏩ Pre-filled Message</h3> <p>Text that appears in the WhatsApp chat window when the user clicks on the WhatsApp.</p> <p>Users can easily start the conversation.</p> <p>Variables to change values dynamically</p> <ul> <li><strong>{site}</strong> -&gt; Website Title</li> <li><strong>{title}</strong> -&gt; Page Title</li> <li><strong>{url}</strong> -&gt; Web page URL</li> <li><strong>[url]</strong> -&gt; Web page full URL including query parameters</li> </ul> <p>With these variables, we can understand from which page the user started WhatsApp chat.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/pre-filled-message/" rel="nofollow ugc">Pre-filled Message</a></p> <h3>🛍️ WooCommerce</h3> <h3>WooCommerce product pages</h3> <p>For WooCommerce, single product pages can overwrite the main setings to add a product specific message using dynamic variables.</p> <ul> <li>Pre-filled Message</li> <li>Call to Action</li> <li>Greetings Template, Content [PRO]</li> </ul> <p>Additional variables, specific to WooCommerce single product page to change values dynamically</p> <ul> <li><strong>{product}</strong> -&gt; Product Name</li> <li><strong>{price}</strong> -&gt; Product Price (current price)</li> <li><strong>{regular_price}</strong> -&gt; Regular product price (without any sale)</li> <li><strong>{sku}</strong> -&gt; Stock keeping unit</li> </ul> <p>For Shop, Cart, Checkout, and Account pages we can overwrite at page level settings</p> <h3>Add WhatsApp &#8211; Single Product Pages</h3> <p>Add WhatsApp button or icon at WooCommerce single product pages.</p> <ul> <li>Before Main Content</li> <li>Before Product</li> <li>Before Product Summary</li> <li>Product Summary</li> <li>Before Add to Cart Form</li> <li>Before Cart Button</li> <li>After Cart Button</li> <li>After Add to Cart Form</li> <li>After Product</li> <li>After product summary</li> </ul> <p>We can add dynamic variables for the Call to Action.<br /> E.g. Buy {product}<br /> {product} will be replaced with the product name for all product pages.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/add-whatsapp-in-woocommerce-single-product-pages/" rel="nofollow ugc">Add WhatsApp Icon/Button in WooCommerce Product pages</a></p> <h4>Add WhatsApp &#8211; Shop Page</h4> <p>Add WhatsApp to WooCommerce Products list (shop page, related products list)</p> <p><a href="https://holithemes.com/plugins/click-to-chat/whatsapp-chat-in-woocommerce-shop-page/" rel="nofollow ugc">Shop page</a></p> <h3>📒 Page Level Settings</h3> <p>At the page level, we can overwrite the settings for each post. We can add a different Whatsapp Number, Prefilled Message, Call to Action for each post<br /> (while editing the post, in the right sidebar &#8216;Click to Chat&#8217; meta box)</p> <ul> <li>WhatsApp Number</li> <li>Call to Action</li> <li>Pre-filled Message</li> <li>Display Settings</li> </ul> <p>PRO:</p> <ul> <li>Change Styles</li> <li>Time Delay</li> <li>Scroll Delay</li> <li>Greetings Template</li> <li>Greetings Header, Main, Bottom Content</li> </ul> <p><a href="https://holithemes.com/plugins/click-to-chat/change-values-at-page-level/" rel="nofollow ugc">Page-level settings</a></p> <h3>📈 Analytics</h3> <p>Creates an Event when the user clicks on the WhatsApp Icon/button.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/google-analytics/" rel="nofollow ugc">Google Analytics</a></p> <p><a href="https://holithemes.com/plugins/click-to-chat/facebook-pixel/" rel="nofollow ugc">Meta Pixel</a></p> <p><a href="https://holithemes.com/plugins/click-to-chat/google-ads-conversion/" rel="nofollow ugc">Google Ads Conversations</a></p> <h3>Webhooks</h3> <p>Connect other applications using Integrate, Automation tools like Zapier, IFTTT, Pipedream, etc.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/webhooks" rel="nofollow ugc">Webhooks</a></p> <h3>⭐ PRO</h3> <ul> <li>Multi-Agent: Displays multiple WhatsApp chat accounts <ul> <li>Set multiple time ranges for each agent&#8217;s availability</li> <li>Hide offline agents or display agent when offline with next available time</li> </ul> </li> <li>Random Numbers: Navigates to a random WhatsApp number from the predefined list</li> <li>Form: Get the necessary information from the website visitors, before initiating the chat <ul> <li>Get an email notification when the user fills out the form.</li> <li>Use webhooks to send form data to external apps in real-time for seamless integration.</li> <li>Prefill WhatsApp messages with user-provided form data to streamline conversations</li> </ul> </li> <li>Business hours: Offline/Online Settings <ul> <li>Set business hours for a specific time range within a day, specific days in a week.</li> <li>Hide the widget during offline hours or automatically change the WhatsApp numbers and call to action.</li> </ul> </li> <li>Display based on website visitor&#8217;s country</li> <li>Webhooks &#8211; Dynamic variables <ul> <li>{url} &#8211; Current page URL.</li> <li>{time} &#8211; Time user interacted with the WhatsApp Button/Icon.</li> <li>{number} &#8211; WhatsApp Number associated with the icon/button.</li> <li>Get values from url parameters by adding name with in single square brackets E.g. [gclid], [utm_source]</li> <li>Get values from cookies by adding the name with in double square brackets. E.g. [[cookie_name]]</li> </ul> </li> <li>Get additional values at Google Analytics, Meta Pixel <ul> <li>Get values from url parameters. E.g. [gclid], [utm_source]</li> <li>Get values from cookies. E.g. [[cookie_name]]</li> </ul> </li> <li>Greetings Actions: (for all greeting dialogs: Greetings-1, Greetings-2, Form, Multi-agent) <ul> <li>Display greetings dynamically based on user actions such as <ul> <li>Time: Time spent on the page, </li> <li>Scroll: Page scroll percentage, </li> <li>Click: specific button clicks </li> <li>ViewPort: when an element becomes visible in the viewport.</li> </ul> </li> </ul> </li> <li>Position to place <ul> <li>Fixed: Fixed position on the screen (default position)</li> <li>Absolute: Fixed position to the body content. (Moves when the user scrolls the page)</li> </ul> </li> <li>Time Delay &amp; Scroll Delay: Display WhatsApp widget after a specified time delay or once the user scrolls a certain percentage of the page.</li> <li>Display based on Website visitor&#8217;s login status</li> <li>Page-level settings: Fine-tune WhatsApp button behavior for individual pages. Change styles, time delays, scroll delay, Greetings Template, and Greetings Content</li> <li>WooCommerce: Customize WhatsApp widget behavior specifically for WooCommerce pages <ul> <li>Overwrite greetings template, Content for Single product pages.</li> <li>Overwrite settings for Shop, Checkout, and Account pages at page-level settings</li> </ul> </li> </ul> <p>🔆 <a href="https://holithemes.com/plugins/click-to-chat/pricing/" rel="nofollow ugc">PRO</a></p> <h3>🎯 Localization</h3> <p>Click to Chat is Compatible with translation plugins. <a href="https://wpml.org/" rel="nofollow ugc">WPML</a>, Polylang.</p> <p>It is easy to set up different values for each language</p> <ul> <li>WhatsApp Number</li> <li>Call to Action</li> <li>Pre-filled Message</li> <li>Greetings Content</li> <li>Group ID</li> <li>Share Text</li> </ul> <p>Setup for <a href="https://holithemes.com/plugins/click-to-chat/translate-click-to-chat-settings-using-wpml-plugin/" rel="nofollow ugc">WPML</a>, <a href="https://holithemes.com/plugins/click-to-chat/translate-click-to-chat-settings-using-polylang-plugin/" rel="nofollow ugc">Polylang</a></p> <h3>🚀 Performance</h3> <ul> <li>Rich in features, but the site’s front end is very lightweight.</li> </ul> <p>We highly concentrate on speed and performance.</p> <h3>👓 Display Settings</h3> <p>Customize the visibility of the widget by showing or hiding styles based on specific settings, such as:</p> <ul> <li>Post type</li> <li>Post Id</li> <li>Category name</li> <li>Device Type(Mobile, Desktop)</li> <li>WooCommerce single product pages</li> </ul> <p>PRO:</p> <ul> <li>Time delay</li> <li>Scroll delay</li> <li>Selected time range in a day</li> <li>Selected Days in a week</li> <li>Website visitor login status</li> <li>Website visitor country</li> </ul> <h3>✅ Opt-in</h3> <p>Make the website users opt-in / accept consent before initiating the chat.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/opt-in/" rel="nofollow ugc">Opt-in</a></p> <h3>⛳ Shortcodes</h3> <p>Use shortcodes to instead a WhatsApp icon or button with inline the Post content, widget area.</p> <p>change the default setting values using shortcode attributes &#8211; WhatsApp Number, Style, Pre-filled message, Call to Action.</p> <h4>Chat Shortcodes</h4> <p>[ht-ctc-chat]</p> <p>To change the WhatsApp number use the &#8216;number&#8217; attribute</p> <p>[ht-ctc-chat number=915123456789]</p> <p><a href="https://holithemes.com/plugins/click-to-chat/shortcodes-chat/" rel="nofollow ugc">Shortcodes for Chat</a></p> <h4>Group</h4> <p>Enable the Group chat feature and add WhatsApp Group id in the plugin settings.</p> <p>Make it easy for your customers to join Whatsapp Group.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/group-chat-feature/" rel="nofollow ugc">Group</a></p> <h4>Share</h4> <p>Let users share your website with their WhatsApp contacts and get more leads.</p> <p><a href="https://holithemes.com/plugins/click-to-chat/share-feature/" rel="nofollow ugc">Share</a></p> <h4>🌏 Help Translate The Plugin</h4> <p>Help by <a href="https://translate.wordpress.org/projects/wp-plugins/click-to-chat-for-whatsapp/" rel="nofollow ugc">Translating the plugin</a> to be available in more languages</p>
WordPress Plugin DirectoryWordPress Plugin Directory
20M