CVE WATCH / VULNERABILITY DETAIL
CVE-2026-87764
HIGHCVSS 8.8NVD feed
Published 11 October 2026 · tracked since 12 October 2026
Description
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-108753 CRITICAL 9.4
- CVE-2026-96227 HIGH 8.8
- CVE-2026-89232 HIGH 8.6
- CVE-2026-89234 HIGH 8.6
- CVE-2026-89283 HIGH 8.6
- CVE-2026-89285 HIGH 8.6
- CVE-2026-89287 HIGH 8.6
- CVE-2026-89297 HIGH 8.6
- CVE-2026-88826 HIGH 8.8
- CVE-2026-88827 HIGH 8.8