CVE-2026-87764

Executive Summary

CVE-2026-87764 is a stored (persistent) cross-site scripting vulnerability in the "BuddyPress Instant Chat" WordPress plugin affecting all versions through 1.6. The plugin fails to verify that a chat message's sender is actually a participant in the target conversation, and it does not escape message content before rendering it back to viewers. This allows any unauthenticated attacker to inject arbitrary JavaScript into a conversation, which executes in the browser session of any member (including administrators) who subsequently opens that conversation, enabling session theft, credential harvesting, privilege escalation, or full site compromise.

Technical Analysis

The vulnerability sits at the intersection of two distinct broken controls, as described in the NVD entry:

1. Missing authorization check on message ownership. The plugin does not verify "that the sender of a chat message belongs to the conversation it is being added to." In a correctly implemented chat system, the server must confirm that the authenticated (or otherwise identified) sender is a legitimate member of the target conversation before persisting a message. The failure to enforce this membership check means an attacker can write messages into conversations they do not own or belong to — including conversations between other users or with site administrators. The description explicitly notes this can be done by unauthenticated users, meaning no login is required to reach the message-submission logic.

2. Missing output escaping (stored XSS). Message content is stored and then "outputting it back" without escaping. Because no output encoding is applied when the message is rendered into the chat view, attacker-controlled content is interpreted as HTML/JavaScript by the browser of any member who later views that conversation. This is the classic definition of stored XSS (CWE-79), and it is stored — not reflected — because the payload persists on the server and fires whenever the poisoned conversation is opened.

The combined impact is a persistent, unauthenticated-to-any-viewer XSS primitive. The source of the script and the execution context are different parties: the unauthenticated attacker supplies the payload, and an authenticated member (potentially a privileged administrator viewing a support/moderation conversation) executes it. This asymmetry is what elevates the practical severity — the victim's session is what carries the privilege.

Attack surface: The publicly reachable chat message-submission path of the plugin, which accepts message content and a conversation reference without requiring authentication or validating conversation membership. No public proof-of-concept, nuclei template, or exploit code is available, so the precise parameter names and endpoint paths are not published in the provided data; the analysis above is derived strictly from the vulnerability class and the NVD description.

CWE mapping: CWE-79 (Improper Neutralization of Input During Web Page Generation — 'Cross-site Scripting'). The missing membership check is best characterized as a missing authorization/integrity control that widens the write surface.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored XSS plus missing authorization) and the NVD description. It does not rely on any fabricated endpoint or parameter names.

1. Reconnaissance / target identification. The attacker identifies WordPress installations running the BuddyPress Instant Chat plugin, version 1.6 or lower. This is achievable through plugin fingerprinting (static asset paths, page source markers, or Shodan-style HTTP body/title searches for plugin-specific strings). BuddyPress-based membership sites — often community, membership, or customer-support portals — are the target class.

2. Triggering the flaw. Because the sender is not checked against the conversation membership, the attacker submits a chat message referencing a conversation they do not belong to. The submission does not require authentication, so the attacker can do this without any account on the site.

3. Payload / execution. The submitted message content is stored verbatim and later emitted without output encoding. The attacker includes a JavaScript payload in the message body (for example, a script that exfiltrates the victim's cookies or session tokens, or performs authenticated actions on their behalf). When any member opens the poisoned conversation, the browser parses and executes the stored script in the context of the vulnerable site's origin.

4. Post-exploitation impact. Because execution occurs in the victim member's session, an administrator viewing the conversation yields administrator-level compromise. Typical outcomes: session/cookie theft and account takeover, creation of rogue admin accounts, installation of backdoors or malicious plugins, content defacement, or redirection of other users. A member-level victim yields member-level actions; an admin-level victim yields full site control.

Impact Assessment

• Confidentiality / Integrity: Stored XSS in a privileged user's session can expose session credentials and any data the victim can access, and allows the attacker to act as that victim — including content and configuration changes. CVSS confidentiality and integrity impacts are Low in the vector above (placeholder vector; no official score was published — see note).
• Scope: The vulnerability crosses a trust boundary (unauthenticated attacker → authenticated member session), which is represented by Scope:Changed in the placeholder vector.
• Blast radius: Every member who views the poisoned conversation is affected; an administrator who views it exposes the entire WordPress installation. On multi-user BuddyPress communities the potential reach is the full active membership.
• Authentication requirement: None (PR:N) — the attacker does not need an account, lowering the bar for mass exploitation.
• Business impact: Account takeover, unauthorized administrative actions, data exposure of member PII in community/support contexts, reputational damage, and potential regulatory exposure through compromise of user accounts and session data.

Note on scoring: No CVSS score or vector was published by NVD (N/A). The vector shown in METADATA is an analyst placeholder reflecting the described attack characteristics and must not be treated as an official NVD score. EPSS has not yet been assigned by FIRST.org; no EPSS value is fabricated here. The CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: BuddyPress Instant Chat Stored XSS - Suspicious Chat Message Submission
id: 7f1b2c9a-8776-4cve-9a1b-000000087764
status: experimental
description: Detects unauthenticated or unauthorized chat message submissions to the BuddyPress Instant Chat plugin containing script-like payloads.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87764
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_path:
    cs-uri-query|contains:
      - 'instant-chat'
      - 'instant_chat'
      - 'bp-instant-chat'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - '<svg'
      - '<img'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate messages that literally contain HTML/JS snippets (rare)
level: high

YARA Rule

rule CVE_2026_87764_BuddyPress_Instant_Chat_XSS
{
    meta:
        description = "Detects stored XSS payload indicators associated with BuddyPress Instant Chat plugin (<=1.6)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87764"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin1 = "buddypress-instant-chat" ascii wide nocase
        $plugin2 = "bp-instant-chat" ascii wide nocase
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "document.cookie" ascii wide nocase
        $xss5 = "javascript:" ascii wide nocase

    condition:
        any of ($plugin*) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87764 BuddyPress Instant Chat Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"chat"; nocase; http.request_body; content:"<script"; nocase; nocase; http.request_body; content:"document.cookie"; nocase; reference:cve,CVE-2026-87764; classtype:web-application-attack; sid:8776401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST"
     and url.path : "*chat*" and http.request.body.text : ("*<script*" or "*onerror=*")]

Splunk SPL Query

index=web
| search (uri_path="*chat*" OR uri_query="*chat*")
| search (uri_query="*<script*" OR uri_query="*onerror=*" OR uri_query="*document.cookie*" OR form_data="*<script*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,wordpress,">
  <rule id="877640" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <description>CVE-2026-87764 - Possible BuddyPress Instant Chat stored XSS attempt (script payload in chat request).</description>
    <match>chat</match>
    <regex>(\x3Cscript|onerror=|onload=|document\.cookie|javascript:)</regex>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence was found in any tracked source, and no fixed version is documented. Treat the plugin as vulnerable in all versions through 1.6 until a vendor fix is published.

1. Immediate mitigations (no patch available):

   • If the plugin is not business-critical, deactivate and remove it until a fixed release is available. This is the only fully reliable mitigation for a stored XSS that lacks an upstream fix.
   • If the plugin must remain active, place the site behind a WAF/reverse proxy and deploy virtual patching rules that block script-like payloads (e.g., <script, event-handler attributes such as onerror=/onload=, and javascript: URIs) in requests to chat endpoints.
   • Restrict chat functionality to authenticated, verified members where the plugin allows configuration, reducing exposure to unauthenticated submission paths.
   • Enforce a strict Content-Security-Policy that disallows inline script execution to blunt stored-XSS payload execution (a defense-in-depth measure, not a fix).
   • Monitor and audit privileged accounts (administrators) for unexpected session activity and enumerate all members who may have viewed suspect conversations.

2. Patch / upgrade steps:

   • No vendor patch is currently available. Continuously monitor the plugin vendor's release channel and the NVD entry for CVE-2026-87764.
   • When a fixed version is released, upgrade immediately and verify the fix addresses both the missing conversation-membership check and output escaping.
   • Until then, maintain compensating controls (WAF virtual patch) and consider full removal.

3. Long-term hardening:

   • Maintain an inventory of WordPress plugins and versions; monitor for vulnerable/unmaintained plugins and track their CVE status.
   • Apply the principle of least privilege: limit the number of administrator accounts and require re-authentication for sensitive actions.
   • Deploy CSP and secure cookie attributes (HttpOnly, Secure, SameSite) to limit the effectiveness of session theft via XSS.
   • Adopt a routine patch-management and vulnerability-scanning workflow covering third-party plugins.

References

• NVD — CVE-2026-87764: https://nvd.nist.gov/vuln/detail/CVE-2026-87764
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP — Cross Site Scripting (XSS) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• FIRST.org EPSS (score not yet assigned for this CVE): https://www.first.org/epss/

No public proof-of-concept, nuclei template, or exploit code was identified. No exploit-in-the-wild activity or threat-actor campaign is documented in the available data. CVE-2026-87764 is not listed in CISA KEV as of this report.