{"id":"CVE-2026-15785","kind":"vulnerability","aliases":["CVE-2026-15785"],"related":[],"title":"Joinchat WordPress plugin: reflected XSS via query parameter name","description":"The Joinchat – Enhanced \"click to chat\" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.","summary":"The Joinchat click-to-chat plugin for WordPress reflects unsanitized query parameter names into pages through its {HREF} variable. An attacker who tricks a user into clicking a crafted link can run arbitrary scripts in that user's browser.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["joinchat","runtime","wordpress"],"not_affected_if":["no-href-variable-in-cta","plugin-not-installed"],"how_to_check":"- Check whether the Joinchat plugin is installed and its version (all versions up to and including `6.3.1` are listed as affected).\n- Check whether the administrator has set a telephone number and uses the `{HREF}` dynamic variable in the Call-to-Action text.","fix":null,"status":"open","published_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","triaged_at":"2026-11-11T08:27:55+00:00","updated_at":"2026-11-11T08:27:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T08:27:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Joinchat WordPress plugin: reflected XSS via query parameter name","impact":"medium","summary":"The Joinchat click-to-chat plugin for WordPress reflects unsanitized query parameter names into pages through its {HREF} variable. An attacker who tricks a user into clicking a crafted link can run arbitrary scripts in that user's browser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","joinchat"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in a visitor's browser on the site","analyst_note":"Confirm the fixed version from the WordPress plugin page or the NVD entry; the sources given name no fixed version.","how_to_check":"- Check whether the Joinchat plugin is installed and its version (all versions up to and including `6.3.1` are listed as affected).\n- Check whether the administrator has set a telephone number and uses the `{HREF}` dynamic variable in the Call-to-Action text.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-href-variable-in-cta"],"who_is_affected":"Sites running the Joinchat plugin up to and including 6.3.1 where an administrator has configured a telephone number and included the {HREF} variable in the Call-to-Action text. Sites without that configuration are not exposed through this path.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00074,"input_tokens":4674,"output_tokens":545,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-15785':12A,15A '-2026':11A,14A '6.3.1':91C 'action':126C,154C 'administr':137C 'arbitrari':52B,109C 'attack':40B,106C 'browser':58B 'call':152C 'call-to-act':151C 'chat':24B,64C 'click':22B,46B,62C,129C 'click-to-chat':21B 'configur':139C 'craft':48B 'cross':73C 'cross-sit':72C 'cve':10A,13A 'due':92C 'dynam':78C,147C 'enhanc':61C 'escap':99C 'execut':115C 'exploit':133C 'href':37B,77C,146C 'includ':90C,144C 'inject':108C 'input':95C 'insuffici':94C 'joinchat':1A,16B,20B,60C 'link':49B,132C 'make':101C 'name':9A,32B,83C 'number':142C 'output':98C 'page':34B,113C 'paramet':8A,31B,82C 'perform':124C 'plugin':3A,25B,65C 'possibl':103C 'queri':7A,30B,81C 'reflect':4A,28B,71C 'requir':134C 'run':51B 'runtim':17B 'sanit':96C 'script':53B,75C,111C 'site':74C 'success':119C 'telephon':141C 'text':155C 'trick':42B,120C 'unauthent':105C 'unsanit':29B 'user':44B,56B,122C 'variabl':38B,79C,148C 'version':86C 'via':6A,76C,80C 'vulner':69C 'web':110C 'wordpress':2A,18B,27B,67C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Joinchat plugin up to and including 6.3.1 where an administrator has configured a telephone number and included the {HREF} variable in the Call-to-Action text. Sites without that configuration are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["joinchat","medium","runtime","wordpress"],"campaign_type":null,"search_a":"'-15785':12A,15A '-2026':11A,14A 'cve':10A,13A 'joinchat':1A 'name':9A 'paramet':8A 'plugin':3A 'queri':7A 'reflect':4A 'via':6A 'wordpress':2A 'xss':5A","search_b":"'arbitrari':52B 'attack':40B 'browser':58B 'chat':24B 'click':22B,46B 'click-to-chat':21B 'craft':48B 'href':37B 'joinchat':16B,20B 'link':49B 'name':32B 'page':34B 'paramet':31B 'plugin':25B 'queri':30B 'reflect':28B 'run':51B 'runtim':17B 'script':53B 'trick':42B 'unsanit':29B 'user':44B,56B 'variabl':38B 'wordpress':18B,27B","search_c":"'6.3.1':91C 'action':126C,154C 'administr':137C 'arbitrari':109C 'attack':106C 'call':152C 'call-to-act':151C 'chat':64C 'click':62C,129C 'configur':139C 'cross':73C 'cross-sit':72C 'due':92C 'dynam':78C,147C 'enhanc':61C 'escap':99C 'execut':115C 'exploit':133C 'href':77C,146C 'includ':90C,144C 'inject':108C 'input':95C 'insuffici':94C 'joinchat':60C 'link':132C 'make':101C 'name':83C 'number':142C 'output':98C 'page':113C 'paramet':82C 'perform':124C 'plugin':65C 'possibl':103C 'queri':81C 'reflect':71C 'requir':134C 'sanit':96C 'script':75C,111C 'site':74C 'success':119C 'telephon':141C 'text':155C 'trick':120C 'unauthent':105C 'user':122C 'variabl':79C,148C 'version':86C 'via':76C,80C 'vulner':69C 'web':110C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T08:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15785","severity":null,"published_at":"2026-11-11T08:17:18+00:00","modified_at":"2026-11-11T08:17:18+00:00","first_seen_at":"2026-11-11T08:26:05+00:00","fetched_at":"2026-11-11T08:26:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}