CVE-2026-87764: Unauthenticated Stored XSS in BuddyPress Instant Chat WordPress Plugin Through 1.6

Summary

CVE-2026-87764 is a high-severity vulnerability in the BuddyPress Instant Chat plugin for WordPress, affecting all versions through 1.6. According to the vulnerability description, the plugin fails at two separate points: it does not verify that the sender of a chat message actually belongs to the conversation the message is being added to, and it does not escape message content before outputting it back to users. The combination allows unauthenticated users to store arbitrary web scripts inside conversations they are not part of, and those scripts execute in the browser session of any member who later views the affected conversation.

The issue is tracked as CWE-79 (cross-site scripting) and carries a CVSS 3.1 base score of 8.8 (HIGH), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Technical Analysis

The published description documents two distinct defects that chain into a single attack path. Examining each one separately clarifies why the combination earns a HIGH severity rating, and why the user-interaction requirement in the CVSS vector does little to blunt the real-world risk.

Defect 1: no membership check on message submission

When a chat message is added to a conversation, the plugin does not check that the sender belongs to the conversation it is being added to. In practical terms, the write path for chat messages lacks an authorization control: whoever can reach the message-submission functionality can attach a message to a conversation, regardless of whether they participate in it. The description states this is reachable by unauthenticated users, which aligns with the PR:N (no privileges required) metric in the CVSS vector. Functionally, this pattern is consistent with the plugin trusting a conversation reference supplied with the message instead of validating the sender's relationship to that conversation — the kind of missing capability or ownership check bug hunters routinely look for on write operations.

Defect 2: message content is output without escaping

Independently of the authorization gap, the plugin does not escape message content before outputting it back. Message text is stored and later rendered as-is, meaning a browser interprets whatever the message contains as markup rather than as plain text. This is the textbook definition of stored cross-site scripting, classified here as CWE-79: attacker-controlled data is persisted server-side and emitted into a page without output encoding, so the payload survives between the injection request and every subsequent render.

Why the chain matters

Either defect alone would be significant; together they are considerably worse. The missing escaping is what makes stored messages executable, but on its own, an XSS confined to a user's own conversations would be of limited value to an attacker. The missing membership check is what turns this into a genuine threat: an unauthenticated outsider can inject script into conversations between other members — people who may have no knowledge of the attacker's existence. When any member later views that conversation, the stored script executes in their session, exactly as the description states.

The specific endpoint, parameter names, or server-side functions involved are not described in the available data — those implementation details are not fully disclosed. What is disclosed is the behavior: unauthenticated insertion of messages into arbitrary conversations, and unescaped output of message content to members who view those conversations.

CVSS vector breakdown

The CVSS 3.1 vector breaks down as follows:

AV:N — the attack vector is network-based; a remote attacker can reach the vulnerable functionality.
AC:L — low attack complexity; no unusual conditions are needed beyond the described flaws.
PR:N — no privileges are required; the attacker does not need an account on the site.
UI:R — user interaction is required; a member must view the poisoned conversation for the stored script to execute.
S:U — scope is unchanged; the scored impact remains within the vulnerable component's security scope.
C:H/I:H/A:H — high ratings for confidentiality, integrity, and availability impact as scored for this vulnerability.

Affected Software and Versions

The affected product is BuddyPress Instant Chat, a WordPress plugin whose name indicates it adds instant chat functionality to BuddyPress-based community sites. The vulnerability description covers all versions through 1.6, meaning version 1.6 and every earlier release fall inside the affected range.

Product: BuddyPress Instant Chat (WordPress plugin)
Affected versions: through 1.6, per the vulnerability description
Fixed version: not disclosed in the provided data
Vendor: not specified in the provided data

Administrators should not assume any release up to and including 1.6 is safe. Because no patched version is identified in the available sources, verify the current state of the plugin through its official distribution channel before drawing conclusions about a specific installation. The phrasing 'through 1.6' marks the last version known to be affected at the time of publication; it is not a guarantee that later versions are immune.

Impact

The core impact is stored cross-site scripting: arbitrary web scripts, submitted by an unauthenticated attacker, execute in the browser session of any member who later views the conversation containing the malicious message. Because the script runs in the session of the viewing member, actions the application permits that member to take in their browser are within reach of the injected code. This is the standard consequence of script execution inside an authenticated session, and it underpins the High confidentiality and integrity scores in the CVSS vector.

Several characteristics of this vulnerability shape its real-world impact:

Unauthenticated injection. Per the description and the PR:N metric, the attacker needs no account on the target site.
Injection into other people's conversations. The missing membership check means victims are members of conversations the attacker was never part of. Victims need no direct interaction with the attacker; they only need to open a conversation that received a poisoned message.
Persistence. This is stored XSS, not reflected: once the malicious message is in the conversation, every subsequent viewer of that conversation is exposed until the message is removed or the flaw is fixed.
Required interaction. The UI:R metric reflects that the payload does not fire on its own; a member must view the conversation. In a chat plugin, viewing conversations is the product's core purpose, so this requirement is met routinely in normal use.

The availability metric is also scored High (A:H) in the provided vector, although the description itself focuses on script execution in members' sessions; the specific availability consequences are not fully disclosed in the available data.

Exploitation Scenario

The following scenario is illustrative and derived strictly from the vulnerability description. Endpoint paths, parameter names, and payload specifics are not disclosed in the available data, so this walkthrough stays at the functional level.

Reconnaissance. The attacker identifies a WordPress site running BuddyPress with the BuddyPress Instant Chat plugin active at version 1.6 or older.
Injection. Without an account, the attacker submits a chat message whose content consists of arbitrary web script, targeting a conversation they do not belong to. Because the plugin does not check that the sender belongs to the conversation, the message is accepted and attached to it.
Storage. The message content is stored without escaping, alongside the legitimate messages of that conversation.
Trigger. At some later point, a member of that conversation opens it to read messages. The stored script executes in that member's browser session, exactly as the vulnerability record describes.
Repeat exposure. Every additional member who views the conversation triggers the payload again, since the malicious content persists in the message history.

The key asymmetry: the attacker performs a single unauthenticated action, while the exposure extends to every member who reads the affected conversation from that point forward. No relationship between attacker and victim is required at any stage.

Detection and Mitigation

Detection

Inventory WordPress installations for the BuddyPress Instant Chat plugin and compare the installed version against the affected range: all versions through 1.6.
Per the provided data, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Since the flaw involves unescaped message content, conversations containing unexpected HTML or script-like text in messages would be consistent with attempted abuse; the description does not document a specific forensic method, so treat this as a general observation rather than a detection procedure.

Mitigation

The provided data does not disclose a patched release or a vendor advisory. Until a fix is confirmed through official channels, the following general measures apply; these are defensive recommendations, not verified fixes described in the sources.

Deactivate or remove the plugin. With no fixed version identified in the available sources, removing the vulnerable component is the most direct way to eliminate the described attack path.
Restrict unauthenticated writes. The described attack requires an unauthenticated user to reach the message-submission functionality. As defense-in-depth, a WAF or reverse-proxy rule that blocks unauthenticated write requests to the plugin's chat endpoints would remove the delivery path described in the record.
Apply a content security policy. A restrictive CSP can limit what an injected script can do in a victim's browser, though it complements rather than replaces patching.
Review stored conversations. Removing any messages that contain script-like content eliminates already-stored payloads; new submissions remain possible until the plugin is fixed or removed.
Monitor for an official update. Check the plugin's official listing for a release addressing this issue, and treat any version beyond 1.6 as unverified until its behavior is confirmed.

Bug Bounty Angle

For bug bounty hunters, CVE-2026-87764 is a compact case study in chaining an access-control flaw with an output-encoding flaw in a WordPress plugin. The same methodology generalizes to most chat and messaging plugins:

Map the message flow. In an authorized test environment, exercise the chat feature and identify, from proxy history, the request that submits a chat message and the request that renders a conversation.
Test the membership boundary. Replay the message-submission request while referencing a conversation the test account does not belong to. If the message is accepted, the authorization control described in this CVE is absent.
Test the encoding boundary. Submit message content containing HTML metacharacters and script syntax, then view the conversation and check whether the content renders as text or executes as markup.
Test the unauthenticated path. Replay the submission request without authentication. The description states unauthenticated users can store arbitrary web scripts, so an unauthenticated submission succeeding is consistent with the reported behavior.
Chain and document. The membership bypass is the access flaw; the stored XSS is the impact. Demonstrating that an unauthenticated request places script into another member's conversation, which then executes for that member, captures the full severity of the chain.

Two cautions apply. First, test only systems you are permitted to test. Second, review the program's policy before submitting: WordPress plugin vulnerabilities are handled differently across platforms, and the available data for this CVE contains no endpoint or parameter details, so any report must be grounded in your own authorized testing of the plugin rather than in the public description.

Frequently Asked Questions

What is CVE-2026-87764?

A stored cross-site scripting vulnerability (CWE-79) in the BuddyPress Instant Chat WordPress plugin through version 1.6. The plugin neither verifies that a message sender belongs to the target conversation nor escapes message content, so unauthenticated users can store scripts that execute when members view the conversation.

Who can exploit CVE-2026-87764?

Unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-based exploitation with no privileges required, though a member must view the affected conversation for the stored script to execute in their session.

Which versions of BuddyPress Instant Chat are affected?

All versions through 1.6, per the vulnerability description. The provided data does not disclose a fixed release, so treat every version up to and including 1.6 as affected until an official patch is confirmed.

Is there a patch or public exploit?

The provided data discloses no patched version and cites only a WPScan entry; no exploit code is referenced. The vulnerability is also not listed in CISA's KEV catalog per the available data.

References

The following sources are the only references associated with this vulnerability in the provided data:

NVD detail page for CVE-2026-87764: https://nvd.nist.gov/vuln/detail/CVE-2026-87764
WPScan vulnerability entry: https://wpscan.com/vulnerability/4c8836ae-5a1f-48ca-96fd-50a85e014cf6/