CVE-2026-57379

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The FormyChat WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.15.3.

Risk Assessment

An attacker can inject malicious JavaScript that executes in the browsers of administrators and users, potentially leading to session theft, account takeover, or website defacement.

Recommendation

Immediately update the FormyChat plugin to version 2.15.4 or later, which includes a fix for this vulnerability.

Other vulnerabilities in FormyChat

CVE-2026-28571High
The FormyChat plugin versions up to 2.15.7 contain an unauthenticated Broken Access Control vulnerability. An attacker without logging in can gain unauthorized access to functions.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.This issue affects FormyChat: from n/a through <= 2.15.3.