Live › vulnerability › CVE-2026-118071
The Joinchat WordPress plugin before 6.4.2 does not escape the message text of its button block when printing it into an HTML attribute. An author-level user can store a script that runs in the browser of any visitor to the post, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Sites running the Joinchat WordPress plugin older than 6.4.2 that let Author-role or higher users write posts with its button block. Visitors and administrators who open those posts are the targets. Sites without the plugin, or where only trusted editors write content, are lower risk.
No product ranges from the sources yet.
6.4.2 are affected.6.4.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-118071")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.