What is GHSA-f3rx-q599-wf5g?

GHSA-f3rx-q599-wf5g is a security advisory published by GitHub Security Advisories with Medium severity. The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block...

Which CVE IDs does GHSA-f3rx-q599-wf5g cover?

GHSA-f3rx-q599-wf5g covers the following CVE IDs: CVE-2026-118071. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f3rx-q599-wf5g?

GHSA-f3rx-q599-wf5g has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-f3rx-q599-wf5gMediumCVSS 6.8

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-118071 →

📋 Description

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-118071
https://wpscan.com/vulnerability/6ac942c3-d39f-4431-97c4-ba9d8c87df21
https://github.com/advisories/GHSA-f3rx-q599-wf5g