EUVD-2026-60921
GHSA-hxx2-grcw-j9mq
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor authentication required (PR:L); XSS crosses scope boundary into victim browser (S:C); no availability impact is attributable to a script-injection flaw of this type.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions.
AnalysisAI
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a WordPress contributor account on the target installation - unauthenticated remote exploitation is not possible given the PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | With a CVSS 3.1 base score of 6.5 (Medium), the principal risk drivers are the low attack complexity and the changed scope that places third-party browser sessions at risk - even a mid-sized municipal IT team in legnica running a community WordPress site with Wise Chat should treat this as a genuine lateral-privilege concern rather than a theoretical edge case, given how commonly contributor accounts are distributed on collaborative WordPress installations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Wise Chat WordPress plugin to a version released after 3.4 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wise-chat/vulnerability/wordpress-wise-chat-plugin-3-4-cross-site-scripting-xss-vulnerability - a patch is available per vendor advisory, though no specific fixed release version number is independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPost
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote atta
Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.1.3. Rated medium severity (CVSS 5.4), this vulnerab
The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today