---
id: CVE-2026-15462
title: >-
  The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via
  the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX
  action in versions up to, and including, 1.4.2
summary: >-
  The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via
  the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX
  action in versions up to, and including, 1.4.2. This is due to the
  save_form_data(…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: gingerplugins
product: >-
  Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat,
  Email & Message Buttons
affected:
  - >-
    sticky_chat_widget_floating_chat_icons_contact_form_call_click_to_chat_email_message_buttons
    <= 1.4.2
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T15:16:59.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15462'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L141
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L188
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/sticky-chat-widget/tags/1.4.2/includes/front-end.php#L60
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3640407%40sticky-chat-widget%2Ftrunk%2Fincludes%2Ffront-end.php&old=3349742%40sticky-chat-widget%2Ftrunk%2Fincludes%2Ffront-end.php&sfp_email=&sfph_mail=
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/35a49ba9-02a6-47cf-98f0-053b06036b08?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T14:11:25.025369Z'
epss: 0.00304
epssPercentile: 0.206
ingestedAt: '2026-09-11T16:45:47.859Z'
---

## Overview

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing a backtick in an attacker-supplied key to break out of the column-identifier list into raw SQL; additionally, the use of filter_input() bypasses WordPress's wp_magic_quotes() protection, and the widget_id validation loop is skipped entirely when no valid widget_id is supplied, leaving $isValid at 1. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.