CVE-2026-92997: Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter

Q: Who can exploit this issue?

Unauthenticated attackers can exploit it; no WordPress account or plugin-level authentication is required.

Q: What input is involved in the attack?

The affected input is the datacolumn parameter, which is used as a SQL column identifier without proper validation.

Q: Which installations are affected?

Click n Chat Chat Widget Integration installations running a version before 1.1.3 are affected.

Published Oct 21, 2026

Updated

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Affected Software

1 affected component

Click n Chat Chat Widget Integration<1.1.3

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit it; no WordPress account or plugin-level authentication is required.

What input is involved in the attack?

The affected input is the datacolumn parameter, which is used as a SQL column identifier without proper validation.

Which installations are affected?

Click n Chat Chat Widget Integration installations running a version before 1.1.3 are affected.

CVE-2026-92997: Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the attack?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the attack?

Which installations are affected?