Buddypress Instant Chat
Monthly
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.
Stored cross-site scripting in the BuddyPress Instant Chat WordPress plugin (versions through 1.6) lets remote, unauthenticated users inject persistent JavaScript into a chat conversation they do not belong to, because the plugin neither verifies that the message sender is a participant in the target conversation nor escapes message content when rendering it. The injected script stays dormant until a legitimate member - potentially an administrator or other privileged user - loads and views that conversation, which is why exploitation requires user interaction rather than being fully automatic. WPScan has published a proof-of-concept advisory, so publicly available exploit code exists, and although the vendor/NVD score is 8.8, the realistic impact is more contained: script execution within a member's authenticated WordPress session in the context of the affected site, with no direct server-side compromise shown.