The vulnerability allows an authenticated user with Subscriber or higher privileges to supply malicious content through the 'code' parameter in the Smartsupp plugin. The lack of sanitization and escaping means the injected scripts are stored and later executed in the context of any user who loads the affected page, potentially leading to data theft, session hijacking, or defacement. This is a classic Stored XSS flaw identified as CWE‑79.

All installations of the Smartsupp – live chat, AI shopping assistant and chatbots WordPress plugin with a version number less than or equal to 3.9.1 are affected. No later versions were reported to contain the flaw.

The CVSS score of 6.4 indicates a moderate impact, and the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the WordPress site, meaning an attacker must obtain at least Subscriber level credentials to inject the payload. Once injected, the stored script runs for all users visiting the affected page, expanding the attack surface across the user base.