Improper neutralization of input during web page generation in the Alex Volkov Chatter WordPress plugin allows attackers to store malicious scripts in comments or form fields, which are later rendered to users without proper encoding. This stored XSS can lead to execution of arbitrary client‑side code, compromising user sessions, stealing credentials, and revealing site secrets. The weakness follows CWE‑79 and affects all versions up to and including 1.0.1.

WordPress sites that have the Chatter plugin from Alex Volkov installed, versions 1.0.1 and earlier are vulnerable. Any installation with these plugin versions is at risk regardless of other WordPress configuration.

The CVSS score of 7.1 indicates a high severity for this vulnerability. The EPSS score of less than 1% suggests that, at present, exploitation attempts are unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by submitting a malicious comment or form entry that is stored and later served to any user who views that content, making the risk significant for sites with active comment features.