The flaw is an Improper Neutralization of Input During Web Page Generation that allows a stored cross‑site scripting condition. An attacker can embed malicious script content that will be rendered when other site users view pages built with the WordPress Click to Chat – WP Support All‑in‑One Floating Widget. This can expose the site to defacement, phishing, or other client‑side attacks governed by the CWE‑79 weakness.

The vulnerability affects the Ninja Team Click to Chat – WP Support All‑in‑One Floating Widget plugin for WordPress version 2.3.4 and all earlier releases. Systems running a WordPress installation that have this plugin installed are at risk.

The CVSS base score is 6.5, classifying the issue as moderate severity. The EPSS score is less than 1 %, indicating a very low level of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be exploited via a stored XSS vector. Based on the description, it is inferred that an attacker would need to embed malicious payload in the plugin’s content, which could be accomplished by a user with content input privileges or a site administrator. Exploitation requires that the malicious payload be persisted within the plugin’s content and subsequently served to other visitors, enabling client‑side code execution.