[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh-X9ZSLlAoSwT1Zbe8WW90RLD5pmCyouenFvV6sAuWM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":24,"research_verified":25,"research_rounds_completed":26,"research_plan":27,"research_summary":28,"research_vulnerable_code":29,"research_fix_diff":30,"research_exploit_outline":31,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":25,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":25,"source_links":35},"CVE-2026-40765","chatbot-for-wordpress-by-collectchat-unauthenticated-stored-cross-site-scripting","Chatbot for WordPress by Collect.chat ⚡️ \u003C= 2.4.9 - Unauthenticated Stored Cross-Site Scripting","The Chatbot for WordPress by Collect.chat ⚡️ plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","collectchat",null,"\u003C=2.4.9","2.5.0","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-04-21 00:00:00","2026-04-30 14:43:34",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc7349e5f-fd45-44bf-9f9e-c0d109069232?source=api-prod",10,[22,23],"collect.php","readme.txt","researched",false,3,"## Exploitation Research Plan - CVE-2026-40765\n\n### 1. Vulnerability Summary\nThe **Chatbot for WordPress by Collect.chat ⚡️** plugin (versions \u003C= 2.4.9) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin registers a handler for the `admin_init` hook that updates the plugin's global settings without any authentication, authorization, or nonce validation. Furthermore, the stored settings (specifically the chatbot script snippet) are subsequently rendered on every frontend page via the `wp_head` hook without sanitization or escaping.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php` (used to trigger `admin_init` unauthenticated) or any URL that invokes the WordPress admin environment.\n*   **Vulnerable Hook:** `admin_init`\n*   **Vulnerable Method:** `ScriptLoader::admin_init()`\n*   **HTTP Parameter:** `collectchat_script` (POST)\n*   **Authentication:** None required.\n*   **Preconditions:** The plugin must be active. No prior configuration is necessary.\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated attacker sends a `POST` request to `wp-admin\u002Fadmin-ajax.php`.\n2.  **WordPress Internal:** WordPress processes `admin-ajax.php`, which loads `wp-admin\u002Fadmin.php`.\n3","The Chatbot for WordPress by Collect.chat plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin's admin_init handler updates global settings without verifying user authentication, permissions, or nonces, allowing an attacker to inject malicious JavaScript into the chatbot script setting which is then rendered unescaped on all frontend pages.","\u002F\u002F collect.php lines 34-36\nadd_action('admin_init', array(&$this,\n    'admin_init'\n));\n\n---\n\n\u002F\u002F collect.php lines 42-44\nadd_action('wp_head', array(&$this,\n    'wp_head'\n));","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.4.9\u002Fcollect.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.5.0\u002Fcollect.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.4.9\u002Fcollect.php\t2026-02-13 18:31:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.5.0\u002Fcollect.php\t2026-04-08 04:07:58.000000000 +0000\n@@ -1,7 +1,7 @@\n \u003C?php\n \u002F**\n  * Plugin Name: Collect.chat - Chatbot\n- * Version: 2.4.9\n+ * Version: 2.5.0\n  * Plugin URI: https:\u002F\u002Fcollect.chat\n  * Description: Chatbots are the simplest, easiest way to collect leads & data from visitors. Create free chatbot without coding using Collect.chat. Never miss an opportunity by engaging every site visitor.\n  * Author: Collect.chat Inc.\n@@ -167,6 +167,7 @@\n                     if($days >= 7){\n                         $cc_new_URI = $_SERVER['REQUEST_URI'];\n                         $cc_new_URI = add_query_arg('collectchat-ignore-notice', '0', $cc_new_URI);\n+                        $cc_new_URI = esc_url($cc_new_URI);\n                         echo '\u003Cdiv class=\"notice notice-success\">';\n                         echo '\u003Cdiv style=\"display:flex;\">\u003Ca href=\"https:\u002F\u002Fcollect.chat\" class=\"logo\" style=\"margin: auto;\">\u003Cimg src=\"https:\u002F\u002Fcollectcdn.com\u002Fassets\u002Fheart.gif\" width=\"60px\" height=\"60px\"  alt=\"Collect.chat\"\u002F>\u003C\u002Fa>';\n                         printf(__('\u003Cdiv style=\"flex-grow:1;margin: 15px;\">\u003Ch4 style=\"margin: 0;\">Awesome! You have been using \u003Ca href=\"admin.php?page=collectchat\">Collect.chat\u003C\u002Fa> chatbot plugin for more than 1 week 😎\u003C\u002Fh4>\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.4.9\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.5.0\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.4.9\u002Freadme.txt\t2026-02-13 18:31:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcollectchat\u002F2.5.0\u002Freadme.txt\t2026-04-08 04:07:58.000000000 +0000\n@@ -3,7 +3,7 @@\n Tags: chatbot, bot, chat bot, lead generation, chat widget\n Requires at least: 4.5.0\n Tested up to: 6.9\n-Stable tag: 2.4.9\n+Stable tag: 2.5.0\n License: GPLv3\n License URI: https:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-3.0.html\n \n@@ -333,6 +333,9 @@\n 2. WordPress settings page.\n  \n == Changelog ==\n+= 2.5.0 =\n+* Security improvements\n+\n = 1.0.0 =\n * First version\n \n@@ -457,6 +460,9 @@\n * Security fix: Stored XSS vulnerability remediation\n * Enforce server-side capability checks for script meta fields\n \n+= 2.5.0 =\n+* Security improvements\n+\n = 2.4.8 =\n * Support for WordPress 6.9\n * Bug fixes","1. Identify the unauthenticated endpoint by targeting any WordPress admin path that triggers the 'admin_init' hook, such as \u002Fwp-admin\u002Fadmin-ajax.php.\n2. Submit a POST request to this endpoint with the parameter 'collectchat_script' containing a malicious JavaScript payload (e.g., \u003Cscript>alert(document.domain)\u003C\u002Fscript>).\n3. Due to the lack of capability checks or nonce validation in the ScriptLoader::admin_init() method, the payload is saved into the plugin's global 'collectchat-plugin-settings' option.\n4. Navigate to the frontend of the site. The plugin's 'wp_head' hook will retrieve the malicious payload from the database and output it into the HTML header without sanitization, triggering the script in the browsers of all visitors.","gemini-3-flash-preview","2026-05-04 19:07:24","2026-05-04 19:08:17",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","2.4.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcollectchat\u002Ftags\u002F2.4.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcollectchat.2.4.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcollectchat\u002Ftags\u002F2.5.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcollectchat.2.5.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcollectchat\u002Ftags"]