Exploit for CVE-2026-39154

## https://sploitus.com/exploit?id=BC5D7707-5A5A-5786-BD0E-D288963D7239
# Wildfire

### CVE-2026-39154 · Stored XSS in CometChat group messages

Stored cross site scripting. CWE 79. CometChat JS SDK 3.0.12. Disclosed February 2026 as request 42660. The vendor marked it Solved. CVE assigned by MITRE.

## Summary

An authenticated user injects a persistent JavaScript payload into a group message. The vector is the `data.text` parameter of the `/v3.0/messages` endpoint. The platform stores the payload. It executes in the browser of every group member who opens the conversation. No victim interaction is required.

## Root cause

Message text sent through the group endpoint is stored and later rendered to other members without contextual output encoding. Markup inside `data.text` is interpreted as HTML rather than shown as plain text.

## Proof of concept

The payloads sit in the conversation and are stored by the platform.

![Payloads stored in the CometChat widget](payloads.png)

Opening the conversation runs the payload on the CometChat origin.

![The stored payload executes on the platform origin](execution.png)

`payload.txt` holds the crafted request. Send it as an authenticated member of a group you own. Open the conversation as any member. The script runs in that session. A full video proof of concept was provided to the vendor during disclosure.

## Impact

Arbitrary script execution in the session of every group member. Session and token theft. Actions on behalf of the victim. Disclosure of conversation data.

## Fix

Contextually output encode or sanitize `data.text` before rendering it to other members. Test only against an application you own.

## Credit

Abdulaziz Alasaiqah · https://azoz.my/writeups.html