A cross‑site request forgery vulnerability allows a malicious actor to send forged requests that result in stored cross‑site scripting content being saved in the WordPress site. Once the script is stored, it will execute in the browsers of any visitor, enabling defacement, cookie theft, or subsequent attacks that require client‑side code execution. The weakness is classified as CWE‑352, indicating that inadequate verification of the request origin allows unauthorized state changes.

The flaw affects the REVE Chat WordPress plugin for all versions up to and including 6.4.4. Earlier releases are also impacted. The issue is present in the supplied plugin regardless of WordPress core version.

The CVSS base score is 7.1, reflecting a high impact moderate exploitation difficulty. The EPSS score is below 1%, suggesting very low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is via a malicious link or embedded form that a site administrator or user may inadvertently click, causing the forged request to be submitted on behalf of a legitimate user. Successful exploitation would result in a persistent script that runs in every visitor’s browser and does not require additional user interaction beyond loading the affected page.