CVE-2026-8420
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WordPress plugin BLOGCHAT Chat System up to version 1.3.6.3 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on a function. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request if they can trick a site administrator into clicking a link.
Risk Assessment
An attacker can modify plugin configuration and inject malicious scripts, potentially leading to admin account takeover or data theft.
Recommendation
Update the BLOGCHAT Chat System plugin to the latest available version. Add proper nonce validation to all request-handling functions.
Original NVD description (English source)
The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.