6.8
MediumCVSS 3.1 · from CISA
CVE-2026-118071
Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
Joinchat · Cross-site scripting · CWE-79AffectedJoinchat
FixUpdate to 6.4.2 or newer
PublishedOct 30, 06:00 · WPScan
Scored6.8 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
From WPScan
Affected and fixed versions
ProductAffectedFixed inJoinchat6.3.2 – before 6.4.26.4.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known