A content injection flaw in the KiwiChat NextClient plugin allows authenticated users with Contributor or higher roles to embed malicious JavaScript into the plugin’s url parameter. Because the input is stored and then rendered without escaping, every subsequent page view by any user runs the injected code. This flaw is a CWE‑79 Stored Cross‑Site Scripting vulnerability.

The vulnerability applies to the WordPress plugin KiwiChat NextClient, all versions up to and including 6.2. An attacker must be logged in with Contributor level access or higher to exploit the flaw.

The CVSS score of 6.4 reflects moderate severity, and the EPSS score of less than 1% indicates low exploitation probability at this time. The flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access, meaning the attacker must first obtain or create a Contributor‑level account. Once authenticated, the attacker can persistently inject scripts that execute on any client loading the affected page.