Unrated
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block...
CVE-2026-118071
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | Joinchat |
≥ 6.3.2, < 6.4.2 |
6.4.2 |
Original description The description as published by the source.
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com