CVE-2026-15785

MediumCVSS 6.1/10Last modified Nov 11, 2026

Description

The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-157864.4The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directo CVE-2026-157876.4The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-i CVE-2026-157887.5BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed insid CVE-2026-157897.5A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory CVE-2026-15799.8The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabl CVE-2026-157906.4The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_CVE-2026-157917.5A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally CVE-2026-157927.5A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.CVE-2026-157937.5BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git s CVE-2026-157946.4The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in a CVE-2026-157956.4The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode At CVE-2026-157966.4The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bg_video_service_url' Setting in all ver