Joinchat CVE-2026-118071

Requires an authenticated WordPress account with the Author role or above on a site running Joinchat between 6.3.2 and before 6.4.2; the attacker must edit a post using the Joinchat button block and insert a script payload into the block's message field, which is then output unescaped inside a front-end HTML attribute. Exploitation only fires when another user renders that post (UI:R), so impact depends on a privileged user - ideally an administrator - actually viewing the attacker-controlled post. Limiting factors: it is not anonymously exploitable (needs a trusted Author+ account, which rules out untrusted/public users), it requires victim interaction (viewing the post), and it requires the affected version with the button block in use; these constraints are why SSVC rates it Exploitation: none and Automatable: no despite the network vector.

The signals point to a real but bounded, lower-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally questionable for a stored XSS: it marks PR:H yet the description states the Author role (a moderate, not administrative, WordPress privilege) is sufficient, and it uses S:U with C:H/I:H/A:H even though XSS typically crosses into the victim's browser context (scope change) with lower direct technical impact - so the base score likely overstates direct impact and overstates the required privilege. EPSS is very low (0.15%, 4th percentile) and SSVC reports Exploitation: none and Automatable: no, which is consistent: this requires an already-trusted Author-level account and a victim viewing the post, so it is not mass-exploitable. The one strong signal is SSVC Technical Impact: total, reflecting that a payload landing in an administrator's browser can lead to full site compromise. Net: a legitimate stored XSS warranting patching on a normal cadence (vuln.today label this_month), not drop-everything urgency. No KEV listing and no exploit reference are present.

A user who already holds the Author role (or higher) on a WordPress site running Joinchat before 6.4.2 edits a post containing a Joinchat button block and places a malicious script in the button's message field, which is emitted unescaped into an HTML attribute on the front end. When any visitor - including an administrator - views that post, the script executes in their browser, enabling session or account takeover. No public exploit or PoC reference is provided for this CVE.