CVE-2026-118071: Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
An authenticated WordPress user with the Author role or a higher-privileged role can exploit it. Any visitor viewing a post containing the malicious Joinchat button block message may be affected, including administrators.
What access and interaction are required for exploitation?
The attacker needs an account with Author-level access or higher and must be able to create or edit a post containing the Joinchat button block. A victim must visit the affected post for the stored script to execute.
Which plugin versions are affected?
Joinchat versions 6.3.2 through 6.4.1 are affected. The issue is described as fixed in version 6.4.2.