Vulnerability details
CVE-2026-87764
BuddyPress Instant Chat
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
CVSS 3.1
8.8High
Official description
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | BuddyPress Instant Chat | v ≤ 1.6 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/4c8836ae-5a1f-48ca-96fd-50a85e014cf6/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-11
- Last updated
- 2026-10-11
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.27%
Probability of exploitation in 30 days
20%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')