Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-19 | 1 | Disclosure1 |
| 2026-03-03 | 1 | Patch1 |
Shipping update from TalkJS 🚀 • Kotlin Data API now live on Maven Central (com.talkjs:core) • Improved JavaScript Data API subscription handling • Flutter & Components SDK fixes • WordPress security patch (CVE-2026-1055) Full March update: https://changelog.talkjs.com/ https://t.co/zEyGTLUMDj
Post summary
TalkJS announces a WordPress security patch for CVE-2026-1055, along with other SDK updates.
CVE-2026-1055 The TalkJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.1.15 due to insufficient input s… https://www.cve.org/CVERecord?id=CVE-2026-1055
Post summary
The CVE‑2026‑1055 disclosure details a stored XSS flaw in the TalkJS WordPress plugin up to version 0.1.15, but offers no PoC, exploit, or patch information.