CVE-2026-87764
Received Received - Intake

Unauthenticated Stored XSS in BuddyPress Instant Chat WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-87764
EUVD
EUVD-2026-96772

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown BuddyPress Instant Chat 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the BuddyPress Instant Chat WordPress plugin versions 1.6 and below. It allows attackers to inject malicious scripts into chat messages without authentication. The plugin fails to verify if the sender belongs to the conversation and does not escape message content before displaying it.

Detection Guidance

Check if your WordPress site uses the BuddyPress Instant Chat plugin version 1.6 or below. Inspect chat messages for unusual or unexpected scripts in the content. Look for conversations where unauthenticated users have sent messages.

Impact Analysis

Unauthenticated users can store arbitrary scripts that execute when other members view the conversation. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties and reputational damage if exploited.

Mitigation Strategies

Disable or uninstall the BuddyPress Instant Chat plugin immediately if you are using version 1.6 or below. Monitor your site for suspicious activity or unauthorized script injections. Check for updates from the plugin developer for a potential fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart