The Click to Chat plugin for WordPress is vulnerable to stored cross‑site scripting through the data‑no_number parameter. Authenticated users with Contributor level or higher can inject arbitrary JavaScript into the plugin’s output. Once injected, the script executes whenever a user views a page that includes the plugin, potentially allowing attackers to steal session cookies, hijack accounts, deface content, or redirect users to malicious sites.

WordPress sites running the HoliThemes Click to Chat plugin, all versions up to and including 4.22. Any site that has deployed this plugin without an upgrade to a later version is affected.

The CVSS score of 6.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Contributor or higher privileges, meaning the attack vector is internal. An attacker can leverage the injected script to compromise the integrity and confidentiality of site visitors that interact with the affected pages.