CVE-2026-118071

MediumCVSS 6.8/10Last modified Oct 30, 2026

Description

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownJoinchat>= 6.3.2, < 6.4.2

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1180725.4The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letCVE-2026-1180738.8Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-1180747.2Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-1180758.8Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-1180768.8Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.CVE-2026-1180777.2Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.CVE-2026-1180787.2Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-1180797.2Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.ThCVE-2026-1180808.8Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.CVE-2026-1180818.8Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.CVE-2026-1180828.8Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.CVE-2026-1180837.5Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-118071: Medium severity, CVSS 6.8 | Vulnix