CVE-2026-87764: BuddyPress Instant Chat XSS Vulnerability

CVE-2026-87764 Overview

CVE-2026-87764 is a stored Cross-Site Scripting (XSS) vulnerability in the BuddyPress Instant Chat WordPress plugin through version 1.6. The plugin fails to verify that a message sender belongs to the conversation being updated. It also fails to escape message content before rendering it in the browser. Unauthenticated attackers can inject arbitrary JavaScript into any conversation. The payload executes in the browser session of any member who later views the affected thread. The flaw maps to [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can store JavaScript in any conversation and hijack sessions of authenticated BuddyPress members, including administrators.

Affected Products

BuddyPress Instant Chat WordPress plugin, all versions through 1.6
WordPress sites running BuddyPress with the Instant Chat extension enabled
Any BuddyPress community that exposes chat conversations to authenticated members

Discovery Timeline

2026-10-11 - CVE-2026-87764 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-87764

Vulnerability Analysis

The BuddyPress Instant Chat plugin exposes a message-posting endpoint that accepts a conversation identifier and message body. The endpoint does not verify that the submitting user is a participant in the referenced conversation. It also does not require authentication for the write path. An attacker can enumerate conversation identifiers and inject messages into any thread on the site.

The second defect is an output-encoding failure. Messages are stored verbatim and rendered without HTML escaping when a member loads the conversation view. Any HTML or JavaScript supplied by the attacker executes under the origin of the WordPress site.

Because the payload fires in an authenticated member's browser, the attacker inherits that member's session context. If an administrator views the conversation, the attacker can create new admin users, install malicious plugins, or exfiltrate nonces to pivot further into the site.

Root Cause

Two missing controls combine to produce the vulnerability. First, the message handler lacks a membership check that would reject writes from users outside the conversation. Second, the renderer lacks contextual output escaping on message bodies. Either control alone would have blocked exploitation.

Attack Vector

Exploitation requires network access to the WordPress site and no authentication. An attacker submits a crafted request to the chat message endpoint containing a target conversation identifier and a script payload in the message body. The attack completes when any legitimate member later opens the poisoned conversation, satisfying the user-interaction requirement.

The vulnerability is described in prose because no proof-of-concept code is published. Refer to the WPScan Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-87764

Indicators of Compromise

Chat messages in the plugin's database tables containing <script>, onerror=, onload=, or javascript: substrings
New WordPress administrator accounts created shortly after a privileged user viewed a chat thread
Unexpected plugin installations or theme file modifications correlated with chat activity
Outbound requests from administrator browsers to unfamiliar domains while viewing BuddyPress pages

Detection Strategies

Query the plugin's message storage for HTML tags or event-handler attributes within message bodies
Review web server access logs for unauthenticated POST requests to the chat message endpoint from a single source across multiple conversation identifiers
Correlate browser-side errors or Content Security Policy violations with specific chat thread URLs

Monitoring Recommendations

Enable WordPress audit logging for user and role changes, plugin installs, and option updates
Deploy a Web Application Firewall rule that blocks script tags and common XSS vectors in chat POST bodies
Alert on administrator session activity originating from unusual IP addresses or user agents following BuddyPress page loads

How to Mitigate CVE-2026-87764

Immediate Actions Required

Deactivate the BuddyPress Instant Chat plugin until a fixed version is available
Audit stored chat messages for malicious payloads and purge affected rows
Rotate credentials and session tokens for any administrator who viewed chat threads during the exposure window
Review recently created users, plugins, and scheduled tasks for signs of compromise

Patch Information

No vendor patch is referenced in the available advisory data. The plugin is vulnerable through version 1.6. Monitor the WPScan Vulnerability Advisory and the plugin's WordPress.org listing for a fixed release.

Workarounds

Remove or disable the BuddyPress Instant Chat plugin from all WordPress installations
Restrict access to chat endpoints at the web server or WAF layer until a fix ships
Enforce a strict Content Security Policy that blocks inline scripts on BuddyPress pages
Limit administrator browsing of community pages from privileged sessions and use separate low-privilege accounts for member interactions

bash

# Example WAF rule concept: block script tags in chat POST bodies
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026877640,msg:'Potential BuddyPress Instant Chat XSS'"
  SecRule ARGS_POST "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none"