CVE-2026-66636
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Stored XSS vulnerability in the Wise Chat plugin by Marcin. Improper input neutralization during page generation allows persistent execution of malicious scripts.
Risk Assessment
A malicious script can be executed in the browser of an administrator or other users, potentially leading to data theft, session hijacking, or content corruption.
Recommendation
Update the Wise Chat plugin to a version newer than 3.4.3 if a patch is available. Restrict content input capabilities for unauthorized users.
Other vulnerabilities in Wise Chat
See all- CVE-2026-39730High
A missing authorization vulnerability in Marcin Wise Chat (wise-chat) allows exploiting incorrectly configured access control security levels. This affects versions through 3.4.3.
- CVE-2026-81784High
A vulnerability in the Wise Chat plugin (versions up to 3.4.2) involves deserialization of untrusted data, allowing Object Injection. This can lead to unauthorized actions in the application.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS