Get real-time updates on Telegram
CVE-2026-87764: BuddyPress Instant Chat 0 through 1.6
CVE-2026-87764. CVSS 3.1 base score 8.8 (HIGH, Source advisory).
Affected technology
BuddyPress Instant Chat · 0 through 1.6
Vendor not specified by the source
Description’s affected range: through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required
What an attacker can do
Unauthenticated users can store arbitrary web scripts that will execute in the session of any member who later views that conversation. Source advisory’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-79
- CCR priority
- 35.2 /100 (P4)
- CVSS 3.1
- 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · Source advisory
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-11 14:36:08.397997+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-11 14:33:42.764061+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-87764.html