mediumCVE-2026-15759

ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes

Q: What is affected by CVE-2026-15759?

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form versions listed as affected should be reviewed: up to and including 3.5.1.

Q: What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

Q: How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

Q: How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Browse WordPress security risks

ProductChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form

CVSS6.4

EPSS0.00201

UpdatedJuly 19, 2026

Quick answer

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.

Who is affected

Affected versions

up to and including 3.5.1

Fixed versions

3.5.2

How to fix it

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form is affected by CVE-2026-15759, a stored cross-site scripting flaw in ChatHelp shortcode attributes. A contributor can place script in the number or group attribute and run it in visitors' browsers. Update ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form to 3.5.2 or a newer vendor-supported patched release. Prioritize exposed production systems and accounts that can reach the affected feature.

Inventory every ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form deployment, version, exposed endpoint, environment, and owner.
Confirm the installed release is not an affected version up to and including 3.5.1.
Update ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form to 3.5.2 or a newer vendor-supported patched release.
Until the update is complete, disable the affected shortcodes or remove contributor publishing access.
Review relevant logs and search posts and revisions for unsafe number or group shortcode values, script tags, and event handlers.
Remove injected shortcode content, clear caches, revoke exposed sessions, and review actions taken by accounts that viewed affected pages.
Clear WordPress, object, page, CDN, and browser caches, then update the asset inventory and close any temporary controls only after validation.

Scan now. Google sign-in is only needed to unlock fix guidance.

Verify the fix

Confirm ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form is on the patched version or mitigation stated above and record the exact deployed version.
Confirm unsafe shortcode attribute values are rejected or escaped and no script runs on the rendered page.
Confirm the affected WordPress REST, AJAX, form, shortcode, upload, export, or admin feature is available only to the roles and requests that need it.
Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-15759.

Related categories

WordPress WooCommerce Cross-site Scripting

Related security risks

More published guidance from the same primary category.

medium

CVE-2026-65475 Modula Image Gallery vulnerability

Updated July 24, 2026

high

CVE-2026-65511 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability

Updated July 24, 2026

medium

CVE-2026-65522 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability

Updated July 24, 2026

Trusted references

Wordfence advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Source advisoryWordfence, NVD Wordfence advisoryWordfence, NVD

FAQ

What is affected by CVE-2026-15759?

ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form versions listed as affected should be reviewed: up to and including 3.5.1.

What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.