CVE-2026-40765

Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting

highImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7.2

CVSS Score

7.2

CVSS Score

high

Severity

2.5.0

Patched in

10d

Time to patch

Description

The Chatbot for WordPress by Collect.chat ⚡️ plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=2.4.9

PublishedApril 21, 2026

Last updatedApril 30, 2026

Affected plugincollectchat

What Changed in the Fix

Changes introduced in v2.5.0

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v2.4.9

Browse source Download .zip

Patched v2.5.0

Browse source Download .zip

Research Plan

Unverified

## Exploitation Research Plan - CVE-2026-40765 ### 1. Vulnerability Summary The **Chatbot for WordPress by Collect.chat ⚡️** plugin (versions <= 2.4.9) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin registers a handler for the `ad…

Show full research plan

Exploitation Research Plan - CVE-2026-40765

1. Vulnerability Summary

The Chatbot for WordPress by Collect.chat ⚡️ plugin (versions <= 2.4.9) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin registers a handler for the admin_init hook that updates the plugin's global settings without any authentication, authorization, or nonce validation. Furthermore, the stored settings (specifically the chatbot script snippet) are subsequently rendered on every frontend page via the wp_head hook without sanitization or escaping.

2. Attack Vector Analysis

Endpoint: /wp-admin/admin-ajax.php (used to trigger admin_init unauthenticated) or any URL that invokes the WordPress admin environment.
Vulnerable Hook: admin_init
Vulnerable Method: ScriptLoader::admin_init()
HTTP Parameter: collectchat_script (POST)
Authentication: None required.
Preconditions: The plugin must be active. No prior configuration is necessary.

3. Code Flow

Entry Point: An unauthenticated attacker sends a POST request to wp-admin/admin-ajax.php.
WordPress Internal: WordPress processes admin-ajax.php, which loads wp-admin/admin.php.
3

Research Findings

Static analysis — not yet PoC-verified

Summary

The Chatbot for WordPress by Collect.chat plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin's admin_init handler updates global settings without verifying user authentication, permissions, or nonces, allowing an attacker to inject malicious JavaScript into the chatbot script setting which is then rendered unescaped on all frontend pages.

Vulnerable Code

// collect.php lines 34-36
add_action('admin_init', array(&$this,
    'admin_init'
));

---

// collect.php lines 42-44
add_action('wp_head', array(&$this,
    'wp_head'
));

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.4.9/collect.php /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.5.0/collect.php
--- /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.4.9/collect.php	2026-02-13 18:31:56.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.5.0/collect.php	2026-04-08 04:07:58.000000000 +0000
@@ -1,7 +1,7 @@
 <?php
 /**
  * Plugin Name: Collect.chat - Chatbot
- * Version: 2.4.9
+ * Version: 2.5.0
  * Plugin URI: https://collect.chat
  * Description: Chatbots are the simplest, easiest way to collect leads & data from visitors. Create free chatbot without coding using Collect.chat. Never miss an opportunity by engaging every site visitor.
  * Author: Collect.chat Inc.
@@ -167,6 +167,7 @@
                     if($days >= 7){
                         $cc_new_URI = $_SERVER['REQUEST_URI'];
                         $cc_new_URI = add_query_arg('collectchat-ignore-notice', '0', $cc_new_URI);
+                        $cc_new_URI = esc_url($cc_new_URI);
                         echo '<div class="notice notice-success">';
                         echo '<div style="display:flex;"><a href="https://collect.chat" class="logo" style="margin: auto;"><img src="https://collectcdn.com/assets/heart.gif" width="60px" height="60px"  alt="Collect.chat"/></a>';
                         printf(__('<div style="flex-grow:1;margin: 15px;"><h4 style="margin: 0;">Awesome! You have been using <a href="admin.php?page=collectchat">Collect.chat</a> chatbot plugin for more than 1 week 😎</h4>
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.4.9/readme.txt /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.5.0/readme.txt
--- /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.4.9/readme.txt	2026-02-13 18:31:56.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/collectchat/2.5.0/readme.txt	2026-04-08 04:07:58.000000000 +0000
@@ -3,7 +3,7 @@
 Tags: chatbot, bot, chat bot, lead generation, chat widget
 Requires at least: 4.5.0
 Tested up to: 6.9
-Stable tag: 2.4.9
+Stable tag: 2.5.0
 License: GPLv3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -333,6 +333,9 @@
 2. WordPress settings page.
  
 == Changelog ==
+= 2.5.0 =
+* Security improvements
+
 = 1.0.0 =
 * First version
 
@@ -457,6 +460,9 @@
 * Security fix: Stored XSS vulnerability remediation
 * Enforce server-side capability checks for script meta fields
 
+= 2.5.0 =
+* Security improvements
+
 = 2.4.8 =
 * Support for WordPress 6.9
 * Bug fixes

Exploit Outline

1. Identify the unauthenticated endpoint by targeting any WordPress admin path that triggers the 'admin_init' hook, such as /wp-admin/admin-ajax.php. 2. Submit a POST request to this endpoint with the parameter 'collectchat_script' containing a malicious JavaScript payload (e.g., <script>alert(document.domain)</script>). 3. Due to the lack of capability checks or nonce validation in the ScriptLoader::admin_init() method, the payload is saved into the plugin's global 'collectchat-plugin-settings' option. 4. Navigate to the frontend of the site. The plugin's 'wp_head' hook will retrieve the malicious payload from the database and output it into the HTML header without sanitization, triggering the script in the browsers of all visitors.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/c7349e5f-fd45-44bf-9f9e-c0d109069232?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database