CVE-2026-73187 CRITICAL

CVE-2026-73187: WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability

Vendor Gingerplugins
Product Sticky Chat Widget
Weakness CWE-89 · SQLi
Published August 18, 2026
Last update August 18, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Sticky Chat Widget versions up to 1.4.2 contain a SQL injection vulnerability in how the plugin processes user input. An attacker on the network can craft malicious requests to read sensitive data from the site's database without needing to log in or interact with a user. The vulnerability also impacts system availability.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the site's database, including user information and configuration details.

Potential impact on your site

04Site Impact

Attackers can extract database contents, exposing user data and site configuration without your knowledge.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 18, 2026 CVE published
August 18, 2026 Record updated