WP Chat App Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes – CVE-2024-1761 |WordPress Plugin Vulnerability Report

Plugin Name: WP Chat App

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-whatsapp
  • Software Status: Active
  • Software Author: ninjateam
  • Software Downloads: 880,497
  • Active Installs: 100,000
  • Last Updated: March 8, 2024
  • Patched Versions: 3.6.2
  • Affected Versions: <= 3.6.1

Vulnerability Details:

  • Name: WP Chat App <= 3.6.1
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1761
  • CVSS Score: 6.4
  • Publicly Published: March 6, 2024
  • Researcher: Ngô Thiên An (ancorn_) - VNPT-VCI
  • Description: The WP Chat App plugin is found to be vulnerable to Stored Cross-Site Scripting (XSS) through insufficient sanitization and escaping of user-supplied attributes like 'buttonColor' and 'phoneNumber' in its widget/block. This flaw allows authenticated users with contributor-level permissions or higher to embed harmful scripts into web pages, compromising the security of any user accessing these pages.


The WP Chat App, a widely used WordPress plugin that facilitates direct chat capabilities via WhatsApp integration, harbors a significant security flaw in versions up to 3.6.1. This vulnerability, identified as Authenticated Stored Cross-Site Scripting via Block Attributes, jeopardizes website integrity by enabling the injection and execution of arbitrary web scripts. A corrective update, version 3.6.2, has been released to address this issue.

Detailed Overview:

Discovered by cybersecurity researcher Ngô Thiên An, this vulnerability underscores the critical need for rigorous security practices in plugin development, particularly concerning input validation and data handling. The ability for attackers to exploit such vulnerabilities can lead to data breaches, unauthorized access, and a tarnished website reputation. The prompt issuance of a patched version by the developers, ninjateam, reflects a proactive approach to maintaining user trust and security.

Advice for Users:

  • Immediate Action: Users are strongly advised to update their WP Chat App plugin to the patched version 3.6.2 without delay to mitigate the risk posed by this vulnerability.
  • Check for Signs of Vulnerability: Regularly inspect your website for any anomalies or unauthorized changes that could indicate exploitation, focusing on areas where the plugin operates.
  • Alternate Plugins: While the updated version is secure, exploring alternative chat plugins may be wise if they better align with security expectations and functional requirements.
  • Stay Updated: Consistently keeping all WordPress plugins, themes, and core installations updated is essential for safeguarding against known vulnerabilities and ensuring optimal website performance.


The identification and subsequent resolution of CVE-2024-1761 within the WP Chat App plugin serve as a pertinent reminder of the dynamic and ongoing nature of cybersecurity threats. WordPress site owners, particularly small business operators who might lack extensive IT resources, must remain vigilant and proactive in applying software updates. Such diligence is paramount in protecting digital assets and maintaining the trust and safety of website users.


In the dynamic world of WordPress, where plugins enhance functionality and user experience, the security of these extensions is paramount. The recent discovery of a vulnerability in the WP Chat App plugin, known as CVE-2024-1761, has cast a spotlight on the critical importance of cybersecurity within the WordPress ecosystem. This plugin, designed to integrate WhatsApp chat functionalities directly into websites, has become an essential tool for many. Yet, this vulnerability exposes the inherent risks associated with digital tools, underscoring the necessity for website owners, particularly small business operators, to vigilantly maintain and update their online platforms.

Plugin Overview:

WP Chat App by ninjateam has gained significant traction within the WordPress community, evidenced by its 880,497 downloads and 100,000 active installations. Its primary function is to facilitate seamless communication between website owners and their visitors via WhatsApp, making it an invaluable asset for customer engagement.

Vulnerability Details:

CVE-2024-1761 reveals a Stored Cross-Site Scripting (XSS) vulnerability present in versions up to 3.6.1 of the WP Chat App plugin. Specifically, the flaw resides in the plugin's handling of user-supplied attributes such as 'buttonColor' and 'phoneNumber' within its widget/block. Insufficient sanitization and escaping of these inputs allow authenticated users with contributor-level permissions or higher to inject arbitrary web scripts, which can be executed by others upon accessing the compromised pages.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to various security breaches, including unauthorized data access, manipulation of website content, and the spread of malware among users. Such incidents can severely tarnish a website's reputation, erode user trust, and potentially result in significant losses for businesses relying on their online presence.

Remediation and Prevention:

In response to CVE-2024-1761, the developers at ninjateam have issued a patched version, 3.6.2, addressing the vulnerability. Website owners using this plugin are urged to update to the latest version promptly to protect their sites. Additionally, regular monitoring for unusual activities and ensuring all components of the WordPress site are up-to-date are critical practices for maintaining security.

Previous Vulnerabilities:

This is not the first time vulnerabilities have been discovered in the WP Chat App plugin, with one other issue reported since December 26, 2023. Each incident serves as a learning opportunity and a reminder of the importance of continuous vigilance in the digital realm.

The discovery of CVE-2024-1761 within the WP Chat App plugin highlights the ongoing battle against security vulnerabilities in the WordPress ecosystem. For small business owners, who often juggle numerous responsibilities, understanding the importance of keeping their website's components up-to-date cannot be overstated. Regular updates, along with a proactive approach to website security, can significantly mitigate the risk of vulnerabilities, safeguarding not just the digital platform but the business's integrity and the trust of its users. In the ever-evolving landscape of cybersecurity, staying informed and responsive is key to maintaining a secure and reliable online presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP Chat App Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes – CVE-2024-1761 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment