CVE-2026-73187

CriticalCVSS 9.3

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

32th percentile - higher than 32% of all known CVEs

Summary

An unauthenticated attacker can exploit SQL Injection in Sticky Chat Widget versions up to 1.4.2.

Risk Assessment

Exposure of database data, data modification, or privilege escalation.

Recommendation

Update the Sticky Chat Widget plugin to a version newer than 1.4.2.

Other vulnerabilities in Sticky Chat Widget

CVE-2026-15462High
The Sticky Chat Widget plugin for WordPress (versions up to and including 1.4.2) is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action. An unauthenticated attacker can append additional SQL queries to extract sensitive information from the database.

Original NVD description (English source)

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS