Stored Cross-Site Scripting Vulnerability in Collect.chat Plugin for WordPress

CVE-2026-0736

What is CVE-2026-0736?

The Chatbot for WordPress by Collect.chat plugin is susceptible to a Stored Cross-Site Scripting vulnerability. This flaw arises from inadequate input sanitization and output escaping in the '_inpost_head_script[synth_header_script]' post meta field. Authenticated users with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts into web pages. These scripts will execute when other users visit the compromised pages, potentially leading to unauthorized data exposure and manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References