CVE-2026-92097

{
  "etk_id": "ETK-2026-1534",
  "cve_id": "CVE-2026-92097",
  "display_id": "CVE-2026-92097",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-100770",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary shortcode execution in Click to Chat – HoliThemes",
  "summary": "Click to Chat – HoliThemes for WordPress through version 4.44 is affected. An unauthenticated remote attacker may cause registered WordPress shortcodes to execute when an affected greeting template is used on an archive page.",
  "mitigation": "Upgrade Click to Chat – HoliThemes to version 4.45 or later. Until updating, deactivate the plugin or restrict unauthenticated access to archive pages using the affected greeting templates.",
  "vendor": "holithemes",
  "product": "Click to Chat – HoliThemes",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.44"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Click to Chat – HoliThemes",
      "purl": null
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0053,
  "epss_percentile": 0.4338,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 89.74283146666667,
  "t0_at": "2026-10-14T01:27:15.838000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-14T05:23:12.855577+00:00",
      "days": 0.16385437010416667,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T01:27:15.838000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T01:27:15.838000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T01:27:15.838000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92097"
    }
  }
}