CVE-2026-39696
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Elfsight WhatsApp Chat CC plugin for WordPress (versions up to and including 1.2.0) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in the victim's browser.
Risk Assessment
An attacker can execute arbitrary scripts in the victim's context, potentially leading to data theft or session hijacking.
Recommendation
Update the Elfsight WhatsApp Chat CC plugin to version 1.2.1 or later if available; otherwise, remove or disable the plugin.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through <= 1.2.0.