---
id: "CVE-2026-118071"
kind: "vulnerability"
aliases: ["CVE-2026-118071"]
title: "Joinchat WordPress plugin lets authors inject scripts into pages"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["joinchat", "package", "wordpress"]
not_affected_if: ["only-trusted-editors", "plugin-6.4.2-or-later", "plugin-not-installed"]
published_at: "2026-10-30T06:16:46+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:30:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118071", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# Joinchat WordPress plugin lets authors inject scripts into pages

The Joinchat WordPress plugin before 6.4.2 does not escape the message text of its button block when printing it into an HTML attribute. An author-level user can store a script that runs in the browser of any visitor to the post, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Joinchat plugin version in the WordPress admin Plugins screen; versions below `6.4.2` are affected.
- Look for Joinchat button blocks in posts written by Author-role or higher accounts.

## Fix

- Joinchat WordPress plugin: move to `6.4.2` or later.

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118071

## From the sources

The Joinchat  WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_