CVE-2026-66636
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Wise Chat plugin by Marcin (versions up to 3.4.2) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other attacks.
Recommendation
Update the Wise Chat plugin to the latest version that includes the fix.
Other vulnerabilities in Wise Chat
See all- CVE-2026-39730High
A vulnerability in the Wise Chat plugin (by Marcin) up to version 3.4.2 is due to missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-81784High
A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS