The vulnerability is a Stored Cross‑Site Scripting flaw where user input is improperly neutralized when generating web pages. An attacker can store malicious scripts in the WordPress Chatbox Manager plugin and have them executed in the browsers of any user who views the affected content. This issue is classified under CWE‑79 and can compromise the confidentiality and integrity of the site by allowing arbitrary script execution, session hijacking or defacement.

The affected product is the Chatbox Manager plugin (wa‑chatbox‑manager) developed by alexvtn. All released versions up to and including 1.2.6 are vulnerable; versions prior to the first release are also affected. Site operators using any of these versions of the plugin are at risk.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is less than 1 %, suggesting that the probability of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is injection of malicious JavaScript into stored data that the plugin renders without proper escaping – an attacker who can create or modify chatbox content can achieve execution of arbitrary scripts in the browsers of visitors to that content.