Is Click To Chat For Whatsapp safe?

Plugin details

• Slug: click-to-chat-for-whatsapp
• Requires PHP: 5.6+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• Click to Chat &#8211; HoliThemes [click-to-chat-for-whatsapp] < 3.18.1 [CVE-2022-4480, WordPress Click to Chat Plugin < 3.18.1 is vulnerable to Cross Site Scripting (XSS), Click to Chat <= 3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode, Click to Chat &lt; 3.18.1 - Contributor+ Stored XSS]
• Click to Chat &#8211; HoliThemes [click-to-chat-for-whatsapp] < 4.0 [CVE-2024-3849, Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion, WordPress Click to Chat Plugin <= 3.35 is vulnerable to Local File Inclusion]
• Click to Chat &#8211; HoliThemes [click-to-chat-for-whatsapp] < 4.23 [CVE-2025-5336, Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter, WordPress Click to Chat Plugin <= 4.22 is vulnerable to Cross Site Scripting (XSS), EUVD-2025-18334]
• Click to Chat &#8211; HoliThemes [click-to-chat-for-whatsapp] < 4.40 [CVE-2026-7795, Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter, EUVD-2026-34949]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Joinchat – Enhanced "click to chat" — 700000+ active installs — max PHP 8.4
• Meta for WooCommerce — 400000+ active installs — max PHP 8.4
• Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty — 400000+ active installs — max PHP 8.4
• Social Chat – Click To Chat App Button — 200000+ active installs — max PHP 8.4
• WP Chat App — 100000+ active installs