What is the CVSS score of CVE-2026-8420?

CVE-2026-8420 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

BLOGCHAT Chat System CVE-2026-8420

EUVD-2026-31028 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-xh95-j7j4-ghg2

WordPress CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:39 vuln.today

DescriptionCVE.org

The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the BLOGCHAT Chat System WordPress plugin (all versions through 1.3.6.3) enables unauthenticated remote attackers to both update plugin settings and inject persistent malicious web scripts by tricking an authenticated site administrator into clicking a crafted link. The vulnerability stems from missing or incorrect nonce validation across multiple functions in wp-blogchat-widget.php (lines 208, 215, 222, 293), making it a compound CSRF+Stored XSS risk with Changed scope (S:C) in the CVSS rating. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected component is the BLOGCHAT Chat System WordPress plugin (CPE: cpe:2.3:a:rdbeach:blogchat_chat_system:*:*:*:*:*:*:*:*), authored by rdbeach. The root cause is CWE-352 (Cross-Site Request Forgery) - WordPress plugins are expected to validate nonces (cryptographic one-time tokens) on all state-changing AJAX or form-handling functions to ensure requests originate from legitimate admin sessions. The absence or incorrect implementation of this check across at least four distinct code locations in wp-blogchat-widget.php (lines 208, 215, 222, 293) indicates multiple handler functions are affected. Because the plugin can write attacker-supplied content to the database (settings injection enabling stored XSS), the CVSS scope is rated Changed (S:C), meaning exploitation crosses the security boundary of the originating component and affects the broader WordPress site and its visitors.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the highest available tagged version (1.3.6.3) remains vulnerable per WordPress trac source review. Site administrators should immediately deactivate and remove the BLOGCHAT Chat System plugin until a patched release is confirmed; this is the most effective compensating control, with the trade-off being loss of chat functionality. If removal is not feasible, restrict WordPress admin panel access to trusted IP ranges using server-level controls (e.g., nginx allow/deny directives or WAF rules) to reduce the attack surface for CSRF delivery - note this does not patch the vulnerability but significantly raises the bar for social engineering. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a62186aa-19aa-445b-8fdc-b029bdafd58f and the WordPress plugin repository for a patched release. Upon patch availability, update immediately and audit plugin settings and stored content for previously injected scripts.