Arbitrary file upload in Chat Widget: Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And

CVE-2026-16548

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.

Vulnerability class: Unrestricted File Upload

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (37.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-16548: held from 0.004 to 0.004.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

  • Chat Widget: Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And — versions 0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-16548?
CVE-2026-16548 is a medium-severity vulnerability in Chat Widget: Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 6.5/10. Published 2026-08-04.
How severe is CVE-2026-16548?
Medium severity. CVSS v3 base score is 6.5 out of 10.