Click to Chat for WhatsApp WordPress Plugin Arbitrary Shortcode Execution Vulnerability

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44.

The flaw exists because the greetings_dialog() function builds the {url} template placeholder from a sanitize_text_field()-filtered $_SERVER['REQUEST_URI'] on archive pages, then passes the substituted greeting content to do_shortcode() in the greetings-1 and greetings-2 templates without stripping shortcode delimiters.

Since wp_kses() runs against main_content before the {url} substitution, attacker-controlled URL bytes reach do_shortcode() unfiltered.

• Affected versions: up to and including 4.44
• Attackers: unauthenticated
• Impact: arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin can be executed