CVE-2026-81784
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.
Risk Assessment
An attacker may exploit deserialization to perform malicious operations, such as remote code execution or data manipulation, depending on available gadgets.
Recommendation
Update the Wise Chat plugin to the latest version if a patch is available. Restrict access to chat functionality to trusted users only.
Other vulnerabilities in Wise Chat
See all- CVE-2026-39730High
A vulnerability in the Wise Chat plugin (by Marcin) up to version 3.4.2 is due to missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-66636Medium
The Wise Chat plugin by Marcin (versions up to 3.4.2) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS