The vulnerability is a stored cross‑site scripting flaw that allows malicious input to be saved as part of a chat message and later rendered by other site visitors. Because the input is not properly escaped before insertion into the page, an attacker can embed arbitrary JavaScript. An attacker who succeeds can hijack user sessions, perform phishing attacks, or deface the site for viewing users. The issue is a classic input‑validation weakness, categorized as CWE‑79.

The flaw exists in the WordPress RumbleTalk Live Group Chat plugin, versions up to and including 6.3.5. Users running any of those releases are at risk; newer releases are presumed fixed. The affected product is the RumbleTalk Live Group Chat plugin for WordPress.

The CVSS score of 6.5 indicates a moderate‑severity vulnerability. The EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, which is consistent with the low exploitation likelihood. Based on the description, the likely attack vector is a web‑based input via the chat interface where any visitor, whether authenticated or unauthenticated, can submit a message. If the attack succeeds, the attacker can execute scripts that run within the context of the chat, potentially affecting all users who view the chat content.