The Chat2 plugin for WordPress contains a Cross‑Site Request Forgery (CSRF) flaw that can be exploited to store malicious scripts in the database. An attacker who can trick a legitimate user into visiting a crafted link may therefore push a script that will run in every subsequent browser session that loads the chat page, leading to data theft, site defacement, or compromise of user accounts. The vulnerability is identified as CWE‑352.

The affected product is the WordPress Chat2 plugin, in all releases from its first version up through 4.0. Administrators who have installed Chat2 on any WordPress site must check the current installed version; any installation at or below 4.0 is vulnerable.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1 percent shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread active exploitation yet. The exploitation requires an authenticated session to deliver the payload; attackers typically need to lure a privileged user into visiting a malicious link. The attack vector is likely foreign‑hosted and requires the victim to be logged into WordPress while visiting the link. Overall, the risk is moderate due to the high severity and low exploitation probability, but the potential for widespread cross‑site scripting warrants timely remediation.