BuddyPress Instant Chat: Unauthenticated stored Cross-Site Scripting via chat message
Summary
The BuddyPress Instant Chat WordPress plugin through version 1.6 does not verify that a message sender belongs to the conversation it is added to, and it does not escape message content on output. An unauthenticated attacker can store arbitrary web scripts that execute in the browser session of any member who later views that conversation. The attack requires the victim to open the affected conversation, so the impact is greatest if an administrator views a poisoned chat.
Affected
- BuddyPress Instant Chat plugin, all versions up to and including 1.6
- Developer listed as richardphelps; last release dated 2016
Fixed in
Unknown. No fixed version identified.
Workaround
- No vendor mitigation found.
- Deactivate and remove the plugin if the chat is not business-critical.
- If it must remain, restrict it to trusted users, review and clear existing chat content, and apply a strict Content Security Policy.
Exploitation
- CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); user interaction is required.
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV.
- EPSS about 0.17%.
- No evidence of exploitation in the wild found; public PoC status unclear.
Our recommendation
- Check all WordPress sites for the bp-instant-chat plugin and version 1.6 or earlier.
- If installed on a public site, deactivate and remove it with high priority.
- If removal is not possible, restrict use, review existing chat content and apply a strict Content Security Policy.
- Replace the plugin with a maintained chat or messaging solution.
- Monitor for suspicious chat content and unexpected administrator sessions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- OpenCVE CVE-2026-87764 app.opencve.io
- Vulners NVD CVE-2026-87764 vulners.com
- Patchstack advisory PATCHSTACK:93C00679A195FA72B18FB47D32A3E1DD vulners.com
- WordPress.com plugin listing bp-instant-chat wordpress.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:41.
Original description (NVD)
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.