Reflected Cross-Site Scripting Vulnerability in Joinchat Plugin for WordPress

CVE-2026-15785

What is CVE-2026-15785?

The Joinchat plugin for WordPress, designed to enhance user engagement through 'click to chat' functionality, contains a vulnerability that allows for reflected cross-site scripting via the '{HREF}' dynamic variable. This issue arises from inadequate input sanitization and output escaping, which can be exploited by unauthenticated attackers. If an administrator has configured a telephone number and incorporated the '{HREF}' variable in the Call-to-Action text, attackers could potentially insert malicious scripts that execute when users interact with affected links. This vulnerability affects all versions up to 6.3.1, highlighting the importance of immediate updates to secure the platform.

References