Technical impact
The flaw is an Improper Neutralization of Input During Web Page Generation that allows a stored cross‑site scripting condition. An attacker can embed malicious script content that will be rendered when other site users view pages built with the WordPress Click to Chat – WP Support All‑in‑One Floating Widget. This can expose the site to defacement, phishing, or other client‑side attacks governed by the CWE‑79 weakness.
Affected Systems
The vulnerability affects the Ninja Team Click to Chat – WP Support All‑in‑One Floating Widget plugin for WordPress version 2.3.4 and all earlier releases. Systems running a WordPress installation that have this plugin installed are at risk.
Risk and Exploitability
The CVSS base score is 6.5, classifying the issue as moderate severity. The EPSS score is less than 1 %, indicating a very low level of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be exploited via a stored XSS vector. Based on the description, it is inferred that an attacker would need to embed malicious payload in the plugin’s content, which could be accomplished by a user with content input privileges or a site administrator. Exploitation requires that the malicious payload be persisted within the plugin’s content and subsequently served to other visitors, enabling client‑side code execution.
EUVD