CVE-2026-1055

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
talkjs	TalkJS	<= 0.1.15

References

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-105506.3A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Ap CVE-2026-1055017.8Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-1055037.8Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-1055047.0An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully ex CVE-2026-1055057.8Relative path traversal in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.CVE-2026-1055065.0Buffer over-read in Windows Shell allows an authorized attacker to disclose information locally.CVE-2026-1055077.8An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading CVE-2026-1055097.0Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-105516.1The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable repla CVE-2026-1055107.0Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.CVE-2026-1055117.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet CVE-2026-1055127.5Integer underflow (wrap or wraparound) in Microsoft QUIC allows an unauthorized attacker to deny service over a network.