CVE-2026-1055

Name of the Vulnerable Software and Affected Versions TalkJS plugin for WordPress versions prior to 0.1.16

Description The TalkJS plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts. These scripts execute when a user accesses an injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the TalkJS plugin to version 0.1.16 or later.