WordPress BuddyPress Instant Chat plugin <= 1.6 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin BuddyPress Instant Chat versions = 1.6...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin (versions through 1.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to verify if a chat message sender belongs to the intended conversation, combined with a lack of output encoding for message content. This allows u...

CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

EUVD-2026-96772

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

PT-2026-110046

Name of the Vulnerable Software and Affected Versions BuddyPress Instant Chat versions prior to 1.7 Description Unauthenticated users can store arbitrary web scripts that execute in the session of any member who views the affected conversation. This occurs because the plugin fails to verify if th...

CVE-2026-87764: Improper Neutralization of Input During Web Page Generation

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...