{"id":"CVE-2026-118071","kind":"vulnerability","aliases":["CVE-2026-118071"],"related":[],"title":"Joinchat WordPress plugin lets authors inject scripts into pages","description":"The Joinchat  WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.","summary":"The Joinchat WordPress plugin before 6.4.2 does not escape the message text of its button block when printing it into an HTML attribute. An author-level user can store a script that runs in the browser of any visitor to the post, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["joinchat","package","wordpress"],"not_affected_if":["only-trusted-editors","plugin-6.4.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed Joinchat plugin version in the WordPress admin Plugins screen; versions below `6.4.2` are affected.\n- Look for Joinchat button blocks in posts written by Author-role or higher accounts.","fix":"- Joinchat WordPress plugin: move to `6.4.2` or later.","status":"open","published_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:00+00:00","updated_at":"2026-10-30T06:30:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- Joinchat WordPress plugin: move to `6.4.2` or later.","reach":"internet","title":"Joinchat WordPress plugin lets authors inject scripts into pages","impact":"medium","summary":"The Joinchat WordPress plugin before 6.4.2 does not escape the message text of its button block when printing it into an HTML attribute. An author-level user can store a script that runs in the browser of any visitor to the post, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","joinchat"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in admin browsers, stealing sessions or site control","analyst_note":"","how_to_check":"- Check the installed Joinchat plugin version in the WordPress admin Plugins screen; versions below `6.4.2` are affected.\n- Look for Joinchat button blocks in posts written by Author-role or higher accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-6.4.2-or-later","only-trusted-editors"],"who_is_affected":"Sites running the Joinchat WordPress plugin older than 6.4.2 that let Author-role or higher users write posts with its button block. Visitors and administrators who open those posts are the targets. Sites without the plugin, or where only trusted editors write content, are lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4113,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118071':12A,15A '-2026':11A,14A '6.4.2':24B,69C 'administr':63B,115C 'allow':92C 'attack':107C 'attribut':41B,85C 'author':5A,44B,96C 'author-level':43B 'block':34B,78C 'browser':55B 'button':33B,77C 'could':91C 'cross':104C 'cross-sit':103C 'cve':10A,13A 'end':89C 'escap':27B,72C 'front':88C 'html':40B,84C 'includ':62B,114C 'inject':6A 'joinchat':1A,16B,20B,65C 'let':4A 'level':45B 'messag':29B,74C 'output':80C 'packag':17B 'page':9A 'perform':101C 'plugin':3A,22B,67C 'post':61B,113C 'print':36B 'role':97C 'run':52B 'script':7A,50B,106C 'site':105C 'store':48B,102C 'text':30B 'user':46B,93C 'visitor':58B,110C 'wordpress':2A,18B,21B,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Joinchat WordPress plugin older than 6.4.2 that let Author-role or higher users write posts with its button block. Visitors and administrators who open those posts are the targets. Sites without the plugin, or where only trusted editors write content, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118071","severity":null,"published_at":"2026-10-30T06:16:46+00:00","modified_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}