CVE-2026-118071

Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

Affected

Joinchat

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 15th percentile

Published

2026-10-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6ac942c3-d39f-4431-97c4-ba9d8c87df21/find archive

CVE references

• https://wpscan.com/vulnerability/6ac942c3-d39f-4431-97c4-ba9d8c87df21REFERENCE

References

• CVE Record
• NVD entry