CVE-2026-87764

Name of the Vulnerable Software and Affected Versions BuddyPress Instant Chat versions prior to 1.7

Description Unauthenticated users can store arbitrary web scripts that execute in the session of any member who views the affected conversation. This occurs because the plugin fails to verify if the sender of a chat message is a participant in the conversation and does not escape message content before outputting it. This leads to Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server.

Recommendations Update BuddyPress Instant Chat to version 1.7 or later.