The Wise Chat WordPress plugin allows a malicious actor to persistently insert arbitrary JavaScript code into stored content by exploiting improper sanitization of the X‑Forwarded‑For header. Because the header is stored and later rendered on pages accessed by other site users, an unauthenticated attacker can compromise the confidentiality and integrity of all users’ browsers, leading to credential theft, session hijacking or further attacks. This flaw is an instance of CWE‑79 and is specifically a stored XSS that can be triggered without authentication.

All WordPress sites running Wise Chat version 3.3.4 or earlier are affected. The vulnerability exists in the file `wise-chat/admin/WiseChatKicksTab.php` where the X‑Forwarded‑For header value is accepted without filtering.

The CVSS score of 7.2 indicates high severity, and the EPSS score of 1 % suggests a low but non‑zero probability of exploitation at the time of analysis. The vulnerability is not included in CISA’s KEV catalog. The attack vector is inferred to be a simple HTTP request containing a crafted X‑Forwarded‑For header against the administration endpoint, after which the malicious payload is stored and executed whenever any user visits a page that includes the injected content.