{"id":"CVE-2026-128893","kind":"vulnerability","aliases":["CVE-2026-128893"],"related":[],"title":"Wise Chat WordPress plugin: reflected XSS through 3.4.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.","summary":"Wise Chat's wise_chat_prepare_image_endpoint action echoes the 'data' parameter back as text/html after checking only a data:image/gif;base64 prefix. It has no nonce check. An unauthenticated attacker can run script in a chat user's browser by getting them to follow a crafted link or visit a malicious page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wise-chat","fixed":["3.4.6"],"affected":"<= 3.4.5","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","reflected-xss","wise-chat","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed","updated-to-3.4.6"],"how_to_check":"In WordPress admin > Plugins, check the Wise Chat version; 3.4.5 or lower is affected. Or read the Version header in wp-content/plugins/wise-chat/wise-chat.php. Also check whether the wise_chat_prepare_image_endpoint AJAX action is reachable on the site.","fix":"Update Wise Chat to 3.4.6 or later (released 2026-11-13 per WPSec).","status":"open","published_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","triaged_at":"2026-11-15T15:37:09+00:00","updated_at":"2026-11-15T15:38:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T15:37:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Wise Chat WordPress plugin: reflected XSS through 3.4.5","impact":"medium","summary":"Wise Chat, a WordPress chat plugin by Marcin Wise, does not neutralize input in generated pages, allowing reflected cross-site scripting. An attacker can run scripts in a visitor's browser by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wise-chat"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs scripts in visitors' browsers on the site","analyst_note":"Confirm the fixed version and attack vector from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-128893 and the plugin's WordPress.org changelog.","how_to_check":"- Check the installed Wise Chat plugin version in the WordPress admin under Plugins, or in the `wise-chat` plugin header.\n- Treat any version up to and including `3.4.5` as affected per the sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Wise Chat WordPress plugin at version 3.4.5 or earlier are exposed through reflected XSS in pages the plugin generates. The sources do not state the exact attack path or required settings. Sites without the plugin installed can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4546,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and attack vector from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-128893 and the plugin's WordPress.org changelog.","search":"'-128893':11A,14A '-2026':10A,13A '3.4.5':8A,114C 'action':38B 'affect':108C 'allow':104C 'attack':61B 'back':43B 'base64':52B 'browser':70B 'chat':2A,17A,24B,31B,34B,67B,100C,103C,110C 'check':47B,58B 'craft':77B 'cross':93C 'cross-sit':92C 'cve':9A,12A 'data':41B,50B 'echo':39B 'endpoint':37B 'follow':75B 'generat':91C 'get':72B 'imag':36B 'image/gif':51B 'improp':84C 'input':87C 'issu':107C 'link':78B 'malici':82B 'marcin':98C 'n/a':112C 'neutral':85C 'nonc':57B 'packag':18B 'page':83B,90C 'paramet':42B 'plugin':4A,28B 'prefix':53B 'prepar':35B 'reflect':5A,20B,105C 'reflected-xss':19B 'run':63B 'script':64B,95C 'site':94C 'text/html':45B 'unauthent':60B 'user':68B 'visit':80B 'vulner':96C 'web':89C 'wise':1A,16A,23B,30B,33B,99C,102C,109C 'wise-chat':15A,22B,101C 'wordpress':3A,25B,27B 'wordpress-plugin':26B 'xss':6A,21B,29B 'xss.this':106C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wise Chat WordPress plugin at version 3.4.5 or earlier are exposed through reflected XSS in pages the plugin generates. The sources do not state the exact attack path or required settings. Sites without the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wisechat"],"ptokens":["chat","wise"],"labels":["high","package","reflectedxss","wisechat","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-128893':11A,14A '-2026':10A,13A '3.4.5':8A 'chat':2A,17A 'cve':9A,12A 'plugin':4A 'reflect':5A 'wise':1A,16A 'wise-chat':15A 'wordpress':3A 'xss':6A","search_b":"'action':38B 'attack':61B 'back':43B 'base64':52B 'browser':70B 'chat':24B,31B,34B,67B 'check':47B,58B 'craft':77B 'data':41B,50B 'echo':39B 'endpoint':37B 'follow':75B 'get':72B 'imag':36B 'image/gif':51B 'link':78B 'malici':82B 'nonc':57B 'packag':18B 'page':83B 'paramet':42B 'plugin':28B 'prefix':53B 'prepar':35B 'reflect':20B 'reflected-xss':19B 'run':63B 'script':64B 'text/html':45B 'unauthent':60B 'user':68B 'visit':80B 'wise':23B,30B,33B 'wise-chat':22B 'wordpress':25B,27B 'wordpress-plugin':26B 'xss':21B,29B","search_c":"'3.4.5':114C 'affect':108C 'allow':104C 'chat':100C,103C,110C 'cross':93C 'cross-sit':92C 'generat':91C 'improp':84C 'input':87C 'issu':107C 'marcin':98C 'n/a':112C 'neutral':85C 'page':90C 'reflect':105C 'script':95C 'site':94C 'vulner':96C 'web':89C 'wise':99C,102C,109C 'wise-chat':101C 'xss.this':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T15:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128893","severity":null,"published_at":"2026-11-15T15:16:47+00:00","modified_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","fetched_at":"2026-11-15T15:36:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128893:4050","url":"https://wpsec.com/vuln/WPSEC-2026-3134/","severity":null,"published_at":"2026-11-15T15:38:20+00:00","modified_at":"2026-11-15T15:38:20+00:00","first_seen_at":"2026-11-15T15:38:20+00:00","fetched_at":"2026-11-15T15:38:20+00:00","note":"NVD page returned empty; WordPress.org page gave no changelog text. Facts from WPSec (third party), not vendor, so nothing marked verified. Fix 3.4.6 per WPSec; confirm in the plugin changelog.","cites":["https://wpsec.com/vuln/WPSEC-2026-3134/","https://wordpress.org/plugins/wise-chat/"]}],"documents":[{"id":164112,"url":"https://wpsec.com/vuln/WPSEC-2026-3134/","title":"WPSEC-2026-3134 Wise Chat <= 3.4.5 Reflected XSS","kind":"advisory","source":"analyst","publisher":null,"text":"Affected: all versions up to and including 3.4.5; fixed 3.4.6 (released 2026-11-13). 'data' parameter of wise_chat_prepare_image_endpoint action; only checked data:image/gif;base64 prefix, echoed in text/html; no nonce. Unauthenticated attacker, user interaction needed. CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":164113,"url":"https://wordpress.org/plugins/wise-chat/","title":"Wise Chat - WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}