Security Alert Summary
The Chatbot for WordPress by Collect.chat plugin contains a stored cross-site scripting (XSS) vulnerability in a post meta field that allows authenticated users with Contributor-level access and above to inject JavaScript that will execute when an injected page is viewed. The issue is caused by insufficient input sanitization and inadequate output escaping of the affected post meta.
CVE Details
- CVE ID: CVE-2026-0736
- Affected plugin / component: Chatbot for WordPress by Collect.chat (post meta handling)
- Affected versions: All versions up to and including 2.4.8 (as stated in the CVE entry)
- Published: February 14, 2026 at 7:16:08 AM UTC
- Last modified: February 14, 2026 at 7:16:08 AM UTC
- CVSS v3.1: Base Score 6.4, Severity: MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: The vulnerability can be exploited by authenticated attackers with Contributor-level access and above. CVSS indicates
Privileges Required: LOWandUser Interaction: NONE. - Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
According to the CVE entry, the plugin fails to properly sanitize input and escape output for the post meta field named _inpost_head_script[synth_header_script]. This allows stored cross-site scripting (XSS) where data submitted to that post meta is persisted and later rendered in page output without sufficient escaping. The vulnerability exists in all versions up to and including 2.4.8 as described.
Because the injected script is stored in post meta, it will execute whenever an affected page that includes that post meta is viewed by a user. The CVE description attributes the root cause to insufficient input sanitization and output escaping; no additional functions, endpoints, or fixes are specified in the entry.
How This Could Impact Your Website
In a typical scenario, a site has multiple user roles: a site owner (administrator), internal staff (editors or authors), and external contributors (contributors, contractors). An authenticated contributor who can create or edit posts could add malicious content into the identified post meta field. When other users — including editors or administrators — view the page, the injected script could run in their browser context.
Practical consequences grounded in the CVSS impacts include disclosure of visible or accessible data (confidentiality impact: low) and modification of page content or stored data visible to other users (integrity impact: low). This also raises the risk of targeted phishing or social engineering if attacker-controlled scripts expose email addresses or modify page content to include malicious links. Availability impact is not indicated by the CVE.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially Contributors and other low-privilege accounts that can submit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected changes to posts and post meta.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/collectchat/tags/2.4.8/collect.php#L282
- https://plugins.trac.wordpress.org/browser/collectchat/tags/2.4.8/collect.php#L388
- https://plugins.trac.wordpress.org/browser/collectchat/trunk/collect.php#L282
- https://plugins.trac.wordpress.org/browser/collectchat/trunk/collect.php#L388
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fb62f4c2-ce9f-4958-8b83-cc0d5f4d4647?source=cve
