| #1 | Meta for WooCommerce | 34 | 66 | 186 | 400k+ | | | Non-prefixed hook name |
| #2 | Click to Chat – HoliThemes | 99 | 6 | 2 | 700k+ | | | badly named files |
| #3 | Joinchat – Enhanced "click to chat" | 81 | 18 | 32 | 700k+ | | | wp function not compatible with requires wp |
| #4 | Social Chat – Click To Chat App Button | 56 | 81 | 45 | 200k+ | | | Text Domain Mismatch |
| #5 | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | 26 | 113 | 671 | 400k+ | | | Non-prefixed global variable |
| #6 | WPZOOM Connect: Social Icons Widget, Share Buttons & Click to Chat | 35 | 28 | 31 | 90k+ | | | Input is not sanitized |
| #7 | WP Chat App | 27 | 120 | 274 | 100k+ | | | Alternative PHP tag found |
| #8 | All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements | 25 | 352 | 597 | 40k+ | | | Non-prefixed global variable |
| #9 | Chat Button & Custom ChatGPT-Powered Bot by GetButton.io | 58 | 26 | 8 | 20k+ | | | Non-prefixed function |
| #10 | OneClick Chat to Order | 49 | 677 | 41 | 40k+ | | | Text Domain Mismatch |
| #11 | Buttonizer – Live Chat, AI Chatbot, Call, Chat, Contact Button | 44 | 24 | 71 | 50k+ | | | Non-prefixed constant |
| #12 | Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons | 69 | 22 | 24 | 30k+ | | | Text Domain Mismatch |
| #13 | Cresta Help Chat | 80 | 6 | 6 | 10k+ | | | Output is not escaped |
| #14 | Meks Easy Social Share | 64 | 26 | 3 | 10k+ | | | Output is not escaped |
| #15 | Simple Chat Button | 91 | | 4 | 40k+ | | | Nonce verification recommended |
| #16 | Order on Mobile for WooCommerce | 84 | 14 | 1 | 7k+ | | | Output is not escaped |
| #17 | Simple Webchat | 39 | 142 | 204 | 1k+ | | | Output is not escaped |
| #18 | Add Chat App Button | 41 | 82 | 12 | 2k+ | | | Output is not escaped |
| #19 | Spice Social Share | 99 | 1 | 1 | 4k+ | | | Discouraged text-domain loading |
| #20 | ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form | 33 | 57 | 204 | 1k+ | | | Non-prefixed global variable |
| #21 | Floating Chat Buttons – Click to Call or Chat, Email | 94 | 1 | 1 | 1k+ | | | Output is not escaped |
| #22 | chat-me-now | 75 | 15 | 5 | 4k+ | | | Output is not escaped |
| #23 | Order On Mobile for WooCommerce | 60 | 36 | 15 | 2k+ | | | Output is not escaped |
| #24 | Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads | 77 | 17 | 1 | 10k+ | | | Exception output is not escaped |
| #25 | Notifications for Forms & WordPress Actions | 25 | 309 | 282 | 1k+ | | | Text Domain Mismatch |
| #26 | Widget Click to Chat | 61 | 22 | 4 | 500 | | | Setting is missing a sanitization callback |
| #27 | Spoki – Chat Buttons and WooCommerce Notifications | 32 | 1,074 | 260 | 700 | | | Unsafe printing function |
| #28 | Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code | 100 | | 2 | 500 | | | Non-prefixed constant |
| #29 | Smartarget – Chat Buttons & Engagement Apps | 68 | 31 | 11 | 1k+ | | | Non Singular String Literal Domain |
| #30 | Chatbox Manager | 38 | 855 | 78 | 400 | | | Output is not escaped |
| #31 | Social Chat Widget (⚡ by Callbell) | 71 | 11 | 6 | 600 | | | Output is not escaped |
| #32 | TOCHAT.BE | 73 | 2 | 71 | 800 | | | Request data is not unslashed |
| #33 | WP Click to Chat – Email, Live Chat, Call & Book Now Buttons | 94 | 43 | 47 | 1k+ | | | wp function not compatible with requires wp |
| #34 | Futy.io Leadbots | 65 | 73 | 9 | 2k+ | | | wp function not compatible with requires wp |
| #35 | SMS Extension for Contact Form 7 | 21 | 720 | 1,387 | 400 | | | Non-prefixed global variable |
| #36 | Contact Widgets For Elementor all the contact links you need in one place | 24 | 908 | 1,188 | 500 | | | Non-prefixed global variable |
| #37 | Get Chat App | 62 | 10 | 62 | 400 | | | Request data is not unslashed |
| #38 | Fast Chat Button | 41 | 24 | 188 | 1k+ | | | Non-prefixed global variable |
| #39 | Pulsating Chat Button | 95 | 29 | 3 | 3k+ | | | wp function not compatible with requires wp |
| #40 | Online Contact Widget-多合一在线客服插件 | 26 | 708 | 80 | 800 | | | Non Singular String Literal Domain |
| #41 | Abandoned Checkout Recovery & Order Notifications for WooCommerce | 35 | 108 | 77 | 800 | | | Text Domain Mismatch |
| #42 | WATI Chat and Notification | 35 | 9 | 0 | 600 | | | Missing direct file access protection |
| #43 | WPChat – Live Chat & Messaging Widget for Customer Support | 89 | 6 | 7 | 2k+ | | | wp function not compatible with requires wp |
| #44 | Simpliest Social Share | 42 | 37 | 22 | 600 | | | Unsafe printing function |
| #45 | Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More | 33 | 293 | 215 | 1k+ | | | Text Domain Mismatch |
| #46 | Animated Floating Chat Button | 95 | | 3 | 2k+ | | | Nonce verification recommended |
| #47 | All-in-one Chat Button by anychat.one | 37 | 119 | 69 | 900 | | | Text Domain Mismatch |
| #48 | Bolt CTA Button – Floating Call Button for WordPress | 99 | 1 | 2 | 1k+ | | | trademarked term |
| #49 | Contactus | 97 | 6 | 1 | 500 | | | Non Enqueued Script |
| #50 | Floating Contact Button for MAX and Telegram | 100 | | 0 | 1k+ | | | No open findings |
