CVE-2026-66636: WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability
Published Aug 18, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
Affected Software
1 affected component
Marcin Wise Chat Wise Chat<=3.4.2, <=3.4.3
Event History
Aug 18, 2026
CVE Published
via MITRE·01:59 PM
Data Sourced
via MITRE·01:59 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be considered affected?
WordPress sites using the Wise Chat plugin at version 3.4 or earlier are affected, based on the available information.
2
What access and conditions does an attacker need?
An attacker needs Contributor-level access and user interaction to exploit the issue. The vulnerability is remotely reachable and has low attack complexity.