MEDIUM 6.8 NVD

CVE-2026-118071

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which co

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

References

https://wpscan.com/vulnerability/6ac942c3-d39f-4431-97c4-ba9d8c87df21/

Published: 2026-10-30 · Source: NVD · Feed updated: 2026-10-30

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-10-30 via NVD.

vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.