CVE-2026-15785creapuntome Joinchat – Enhanced “click to chat” cross-site scripting

What it is

Input is written into a web page without escaping, so an attacker's script runs in the browser of anyone who views it.

How it is reached

An attacker can exploit it over the network, without an account, but someone has to act first, such as opening a file or following a link.

What an attacker gains

The direct impact is limited: partial access to data or a partial outage. In practice, this kind of flaw lets an attacker act inside a signed-in user's browser session. The damage can spread past the vulnerable component into others.

Is it being exploited?

There is no public report of exploitation yet.

What to do

1. No fixed version is listed yet. Find every place creapuntome Joinchat – Enhanced “click to chat” runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.
3. Warn the people who use it, and filter files and links on the way in.

Description from NVD

The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text.