CVE-2026-87764: high-severity vulnerability in BuddyPress Instant Chat
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.8epss 0.3%
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · BuddyPress Instant Chatpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/4c8836ae-5a1f-48ca-96fd-50a85e014cf6/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.