CVE-2026-87764: CWE-79 Cross-Site Scripting (XSS) in BuddyPress Instant Chat
Description
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
CVSS v3.1
Score 8.8high
Affected software
BuddyPress Instant Chat
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87764 is a stored cross-site scripting (XSS) vulnerability in the BuddyPress Instant Chat WordPress plugin versions up to and including 1.6. The vulnerability arises because the plugin fails to check that the sender of a chat message is part of the conversation and does not escape message content before outputting it. This allows unauthenticated attackers to inject arbitrary scripts that execute in the session of any user who later views the conversation, potentially leading to session hijacking or other script-based attacks.
Potential Impact
Unauthenticated attackers can store malicious scripts in chat messages that execute in the browsers of authenticated users viewing those conversations. This can lead to session hijacking, theft of sensitive information, or other malicious actions performed with the victim's privileges within the WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the chat functionality and monitor for suspicious activity. Avoid using affected versions of the plugin where possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-09T07:22:46.726Z
- State
- PUBLISHED
Threat ID: 6acb2de32cdf04f656b78d0e
Added to database: 10/11/2026, 06:34:11 UTC
Last enriched: 10/11/2026, 07:03:13 UTC
Last updated: 10/11/2026, 21:33:30 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.