CVE-2026-9644

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-964407.1Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowri CVE-2026-964427.8A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would e CVE-2026-964436.5Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.CVE-2026-964456.8A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the sys CVE-2026-964464.2A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path pr CVE-2026-964486.6A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue CVE-2026-964495.3Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2026-96459.9Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full acces CVE-2026-964505.4Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.CVE-2026-964518.8Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalatio CVE-2026-964548.2Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ CVE-2026-964558.8The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem