Threat database

CVE-2026-39730 is a Missing Authorization vulnerability in Marcin Wise Chat that affects versions up to and including 3.4.3. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity and availability. The vulnerability has a high severity rating with a CVSS score of 7.1. There is no information about an available patch or vendor advisory, and no known exploits in the wild have been reported.

CVE-2026-81784 is a high severity vulnerability in Marcin Wise Chat (versions up to 3.4.2) involving deserialization of untrusted data that allows object injection. This flaw can lead to complete compromise of confidentiality, integrity, and availability. No patch or official fix information is provided.

CVE-2026-66636 is a stored cross-site scripting (XSS) vulnerability in Marcin Wise Chat affecting versions up to and including 3.4.3. The flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. This vulnerability has a medium severity with a CVSS score of 6.5. No official patch or vendor advisory is provided in the available data. There are no known exploits in the wild at this time.

The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including administrator usernames, login timestamps, visitor tracking information, and business intelligence data via the 'name' parameter granted they can send unauthenticated requests.

Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a through <= 1.0.

The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.