CVE-2026-39730
HighCVSS 7.1Summary
A vulnerability in the Wise Chat plugin (by Marcin) up to version 3.4.2 is due to missing authorization, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker can gain unauthorized access to chat features, potentially leading to privacy breaches or manipulation of chat data.
Recommendation
Update the Wise Chat plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Wise Chat
See all- CVE-2026-81784High
A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.
- CVE-2026-66636Medium
The Wise Chat plugin by Marcin (versions up to 3.4.2) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Original NVD description (English source)
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS