CVE-2026-118071
Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
| Vendor | unknown |
| Product | joinchat |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown joinchat
Be the first to know when new unknown vulnerabilities affecting unknown joinchat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Joinchat
6.3.2 < 6.4.2
References
Credits
Qi Qin WPScan