---
id: "CVE-2026-15785"
page: "https://infrastack.ai/live/CVE-2026-15785"
kind: "vulnerability"
aliases: ["CVE-2026-15785"]
title: "Joinchat WordPress plugin: reflected XSS via query parameter name"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["joinchat", "runtime", "wordpress"]
not_affected_if: ["no-href-variable-in-cta", "plugin-not-installed"]
published_at: "2026-11-11T08:17:18+00:00"
first_seen_at: "2026-11-11T08:26:05+00:00"
updated_at: "2026-11-11T08:27:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15785", "first_seen_at": "2026-11-11T08:26:05+00:00"}]
exploit_sources: []
---

# Joinchat WordPress plugin: reflected XSS via query parameter name

Link for people: https://infrastack.ai/live/CVE-2026-15785 (this .md is for agents)

The Joinchat click-to-chat plugin for WordPress reflects unsanitized query parameter names into pages through its {HREF} variable. An attacker who tricks a user into clicking a crafted link can run arbitrary scripts in that user's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Joinchat plugin is installed and its version (all versions up to and including `6.3.1` are listed as affected).
- Check whether the administrator has set a telephone number and uses the `{HREF}` dynamic variable in the Call-to-Action text.

## Timeline

- 2026-11-11T08:26:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15785

## From the sources

The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_