# Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist <= 1.8.4 - Unauthenticated DOM-Based Cross-Site Scripting via Widget Iframe postMessage

- **ID:** WPSEC-2026-3037
- **Plugin:** Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist (`bit-assist`), https://wordpress.org/plugins/bit-assist/
- **Affected versions:** all versions before 1.8.5
- **Fixed in:** 1.8.5 (Update to 1.8.5 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bit-assist
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3037/

## Description

The Bit Assist plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the chat widget iframe page ('clientDomain' parameter and the 'windowLoaded' postMessage) in all versions up to, and including, 1.8.4. This is due to the widget iframe accepting its API endpoint from any window's postMessage without checking the message origin, then inserting the returned widget data (such as the call-to-action text) into the page with innerHTML. The iframe endpoint also accepted any domain in the 'clientDomain' parameter as an allowed frame ancestor without checking that a widget was configured for it. This makes it possible for unauthenticated attackers to run arbitrary web scripts in the context of the affected site if they can trick a user into visiting a page they control, which frames or opens the widget iframe and points it at attacker-supplied widget data.

## References

- https://wpsec.com/vuln/WPSEC-2026-3037/
- https://plugins.svn.wordpress.org/bit-assist/tags/1.8.5/
- https://wordpress.org/plugins/bit-assist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3037/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.