CVE-2026-16548: unknown chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chat
Vulnerability summary
CVE-2026-16548 is a critical (CVSS 9.8) vulnerability in unknown chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chat. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.8.2.
Timeline
- 04-08-2026PublishedVulnerability first disclosed.
- 11-08-2026Last modifiedVulnerability information updated.
Description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.07 pp
From 0.36% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chat< 1.8.2
Wordpress1 product
- bit-assist≤ 1.8.1 (fixed in 1.8.2)
2 vendors · 2 products