This vulnerability allows an authenticated user with Contributor-level access or higher to inject arbitrary JavaScript into the output of the Floating Chat Widget plugin. The flaw originates in the data-hover parameter, which is stored in the database and rendered without proper sanitization or escaping. When a page containing the widget is viewed, any malicious script embedded in that parameter is executed in the victim’s browser. This stored cross‑site scripting can lead to session hijacking, cookie theft, defacement or phishing attacks against site visitors.

The affected product is the WordPress plugin Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty from Premio. Versions up to and including 3.3.5 contain the flaw, so any installation of these plugin versions on any WordPress site is vulnerable.

The CVSS score of 6.4 suggests a moderate impact, and the EPSS score of less than 1% indicates a low probability of exploitation. Exploitation requires an authenticated contributor or higher, so attackers must first compromise such credentials. The vulnerability is not listed in CISA’s KEV catalog. If exploited, malicious scripts would run within the context of the site’s domain, potentially enabling attackers to read or modify user data and deface content.