Stored Cross-Site Scripting in Joinchat WordPress Plugin by Joinchat
CVE-2026-118071
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118071?
The Joinchat WordPress plugin prior to version 6.4.2 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of button block messages. This flaw allows users with Author roles or higher to inject malicious scripts into the frontend output, potentially compromising the security of any user interacting with the affected posts, including administrators.
Affected Version(s)
Joinchat 6.3.2 < 6.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.