External risk intelligence

Sticky Chat Widget Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73187

The vulnerability affects a chat widget plugin, which is a component designed specifically to be embedded on public-facing websites to facilitate user interaction. As a web-based interface component, it is commonly deployed in an internet-facing context where it is directly reachable by external users.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in versions of the Sticky Chat Widget prior to 1.4.2, allowing unauthenticated SQL injection. This flaw impacts web applications utilizing this widget, potentially exposing sensitive data and disrupting services due to its network-accessible nature without requiring user authentication. The primary concern is confirming the relevance and exposure of this widget within your digital assets.

Unauthenticated injection in a chat widget.
Affects public-facing websites; confirms relevance.
Prioritize identifying and addressing exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target unauthenticated users by sending specially crafted SQL queries to the Sticky Chat Widget, potentially leading to unauthorized access to sensitive data or system disruption. This vulnerability exploits a flaw in how the widget handles user input before it reaches the database.

No authentication needed.
SQL injection via widget input.
Risk of data exposure or disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary SQL commands. When successfully exploited, this could potentially lead to unauthorized access to or modification of sensitive data stored within the application's database. The impact depends on the specific database schema and the privileges granted to the application's database user.

Sensitive database information could be exposed.
Via unauthenticated SQL injection.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in the Sticky Chat Widget impacts application owners and platform teams responsible for managing website components. The first practical step is to identify all instances of the affected widget, determine their exposure and business criticality, and then assign an owner for remediation planning.

Application owners should verify exposures.
Confirm reachability and business criticality first.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sticky Chat Widget?

The Sticky Chat Widget is a WordPress plugin component commonly used to add interactive messaging or support features to websites. Because it serves as a bridge for user communication, it is typically installed as a visible element that users interact with directly on a webpage to start conversations.

What does CVE-2026-73187 mean?

This CVE identifies a security flaw known as SQL Injection, classified as CWE-89. In plain terms, the widget fails to properly sanitize or filter data provided by a user before processing it. This allows an attacker to manipulate the underlying database queries to access or interfere with data that should remain private.

How does an attacker trigger this SQL injection?

An attacker triggers this by sending malicious input directly to the widget through the web interface. Since it is unauthenticated, the attacker does not need an account or special permissions to send these requests. Simply browsing the site and interacting with the chat functionality is enough to expose the system to this flaw.

Is my website at risk from this vulnerability?

Halo Surface Signal indicates that because this plugin is designed for public interaction, it is almost certainly internet-facing. If your website uses the Sticky Chat Widget version 1.4.2 or older, it is directly reachable by external users, making your site a potential target for unauthorized database queries.

What should I do if I use this plugin?

Your first step is to perform an inventory to locate every instance of the plugin within your digital environment. Once identified, evaluate the criticality of the data connected to those specific websites. Prioritize these assets for remediation, such as updating the plugin to a secure version or removing it if it is no longer required.

References

patchstack.com/database/wordpress/plugin/sticky-chat-widget/vulnerab…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.