Chat Widget public responses permit unbounded arbitrary-file storage
Chat Widget before 1.8.2 accepts files through its public response endpoint without validating their type, extension, contents or size when response storage or mail forwarding is configured. An unauthenticated attacker can consume disk space or host arbitrary content under the uploads directory. The plugin discards the original extension and stores each file under a bare UUID, so the disclosed behavior does not provide code execution or stored XSS. The advisory does not disclose the endpoint route, upload field or storage path.
- Component
- Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat
- Plugin slug
chat-widget-floating-customer-support-button-for-30-channels-supporting-sms-calls-and-chat- Affected
- < 1.8.2
- Safe version
1.8.2- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Chat Widget to 1.8.2 or later. Review its response-upload storage for unexpected large files, remove untrusted content and monitor available disk space if the vulnerable response-storage or mail-forwarding configuration was enabled.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L