WordPress Plugin Vulnerabilities

Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

Description

The plugin does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
creame-whatsapp-me
Fixed in 6.4.2

References

CVE
CVE-2026-118071

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Qi Qin
Submitter
Qi Qin
Submitter website
https://leoq7.com/
Submitter twitter
LeoQ7_
Verified
Yes
WPVDB ID
6ac942c3-d39f-4431-97c4-ba9d8c87df21

Timeline

Publicly Published
2026-10-28 (about 2 days ago)
Added
2026-10-28 (about 1 day ago)
Last Updated
2026-10-28 (about 1 day ago)

Other

Published
Title
Published
2026-09-28
Title
Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
Published
2025-03-31
Title
Media Library Assistant < 3.25 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2023-03-21
Title
Disqus Conditional Load < 11.1.2 - Admin+ Stored Cross-Site Scripting
Published
2024-08-16
Title
Responsive Blocks – WordPress Gutenberg Blocks < 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-05-26
Title
Modula Image Gallery – Photo Grid & Video Gallery < 2.14.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting