Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨*CVE* CVE-2026-16548 The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extensi… https://www.cve.org/CVERecord?id=CVE-2026-16548 ----- Traducción: CVE-2026-16548 El … http://infoflow.cloud`
Post summary
The post references CVE-2026-16548 with a brief description but provides no details on exploitation, patches, or PoC.
CVE-2026-16548 The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extensi… https://www.cve.org/CVERecord?id=CVE-2026-16548
Post summary
The entry documents an input‑validation flaw in the Chat Widget WordPress plugin (before 1.8.2) but provides no proof‑of‑concept, exploit details, or patch information.
CVE-2026-16548 Arbitrary File Upload in Chat Widget WordPress Plugin Before 1.8.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-16548
Post summary
CVE-2026-16548 is a disclosed arbitrary file upload vulnerability affecting the Chat Widget WordPress plugin in versions prior to 1.8.2.