CVE-2022-3415: Bluecoral Chat Bubble

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message

Affected products

• Bluecoral Chat Bubble: before 2.3 (fixed in 2.3)

Published 2022-11-14. Last modified 2026-06-17.