CVE-2026-87764: BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
An unauthenticated attacker can add a malicious message to a conversation without being a member of it. Any member who later views that conversation may execute the attacker-controlled script in their browser session.
What access or conditions does an attacker need?
The attacker does not need to authenticate or belong to the targeted conversation. They need to be able to submit a chat message to a conversation that will later be viewed by a member.
Are installations running version 1.6 affected?
Yes. The affected versions are stated as BuddyPress Instant Chat through 1.6, which includes version 1.6.