The vulnerability is a CSRF flaw in the WATI Chat and Notification plugin that permits an attacker to submit a crafted request containing arbitrary JavaScript. This code is then saved by the plugin in its database and later executed in the browser of any user who views the affected content. Based on the description, it is inferred that the payload is stored by the plugin and runs with the privileges of the visiting user, potentially stealing session cookies, redirecting the browser, or modifying the page.

Any WordPress installation that uses the Hieu Nguyen WATI Chat and Notification plugin up to and including version 1.1.2. No versions newer than 1.1.2 are known to be affected.

The CVSS score of 7.1 indicates a high‑impact vulnerability with moderate exploitation complexity. The EPSS score of less than 1% signals that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an attacker must persuade an authenticated user to submit a request that contains the malicious payload, after which the stored code will execute for any subsequent visitor. The flaw is classified as CWE‑352, highlighting its CSRF nature.