The AhaChat Messenger Marketing WordPress plugin through version 1.1 fails to sanitize and escape a user‑supplied parameter before rendering it back to the page, resulting in a reflected Cross‑Site Scripting vulnerability. An attacker could embed malicious JavaScript in a crafted link; when an administrator views the page, the script executes in the context of the admin user, potentially allowing session hijacking, credential theft, or other malicious actions on the site. The lack of output encoding further enables the attacker to execute scripts that can compromise the admin session.

WordPress sites running the AhaChat Messenger Marketing plugin, any version up to and including 1.1. No vendor product names beyond the plugin itself are listed.

The CVSS score of 7.1 indicates a high‑severity flaw. The EPSS score is below 1%, reflecting a low but non‑zero probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no public exploits are known. Exposures typically occur via a crafted URL that an admin might visit; the limited attack surface keeps the risk moderate, yet the potential for elevated XSS impact warrants prompt remediation.