Is WhatSender PRO - WhatsApp Bulk Sender safe?

Medium risk

WhatSender PRO sends URLs from outgoing WhatsApp messages to third-party link-preview servers.

When you compose a WhatsApp message, the extension injects a script that wraps WhatsApp's link-preview function and sends the first web link in the outgoing text to remote preview endpoints. Those endpoints can also receive preview image URLs when the extension requests thumbnail data.

emailsoftv4.5.1Chrome Web Store
45Risk
Who publishes it

emailsoft - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
emailsoft

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

Kindle Cloud Reader to PDF Downloader1k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Outgoing WhatsApp message URLs are sent to link-preview servers

Composing a WhatsApp message with a web link makes WhatSender PRO pass that URL, and possibly surrounding text, to link-preview servers: cobrancas.uppermesh.com.br:8000, wajsapi.titanchat.com.br, or wppc-linkpreview.cloudtrix.com.br.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user composes an outgoing WhatsApp Web message containing a link.

The extension did this

The extension forwards the message URL to configured third-party link-preview servers.

Captured request
GEThttps://cobrancas.uppermesh.com.br:8000/v1/link-preview/fetch-data.png; https://wajsapi.titanchat.com.br/v1/link-preview/fetch-data.png; https://wppc-linkpreview.cloudtrix.com.br/v1/link-preview/fetch-data.png
Fields in the request
  • Your message URL
    https://example.com/article

    The web link typed into the outgoing WhatsApp message is sent for preview generation.

  • Message input context
    Check this link: https://example.com/article

    The link is taken from the message text you entered in WhatsApp Web.

Observation

Observed during dynamic analysis: the extension scopes itself to WhatsApp Web, injects its preview hook, and routes outgoing message links through hardcoded link-preview endpoints.

Where it sends data

Destinations our analysis observed WhatSender PRO - WhatsApp Bulk Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • wajsapi.titanchat.com.br

    WhatSender PRO - WhatsApp Bulk Sender sends data to wajsapi.titanchat.com.br. 12 other extensions we have analysed send data here.

  • wppc-linkpreview.cloudtrix.com.br

    WhatSender PRO - WhatsApp Bulk Sender sends data to wppc-linkpreview.cloudtrix.com.br. 12 other extensions we have analysed send data here.

  • cobrancas.uppermesh.com.br:8000

    WhatSender PRO - WhatsApp Bulk Sender sends data to cobrancas.uppermesh.com.br:8000. 2 other extensions we have analysed send data here.

Updated 30 September 2026cpficbpjnbekidkijhpbofgncpfolmeb