The NinjaTeam Chat for Telegram WordPress plugin contains a stored cross‑site scripting flaw triggered by the username field. The plugin fails to sanitize or escape the input before storing it, allowing attackers with Contributor‑level or higher access to insert arbitrary JavaScript. When a page containing the injected username is later viewed, the malicious script executes in the victim’s browser, potentially hijacking sessions, defacing content, or performing other covert actions. This vulnerability directly compromises the integrity and confidentiality of website users browsing affected pages.

WordPress sites using the NinjaTeam Chat for Telegram plugin from any version up to and including 1.1 are affected. The vendor is ninjateam and the product is the WP Telegram Chat Widget. No newer versions are known to fix the issue, so all installations of 1.1 and earlier are vulnerable.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that the exploitation probability is low at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor‑level or higher privileges; the attacker must submit a crafted username value that is then rendered on subsequent pages accessed by other users. Once injected, the script executes in the context of every visitor who loads the affected page.