An authenticated user with Contributor permissions or higher can embed arbitrary JavaScript into the '_inpost_head_script[synth_header_script]' post meta field within the Chatbot for WordPress plugin. Because the plugin does not sanitize input or escape output when saving or displaying this field, the attacker can store malicious scripts that will run in every user's browser when they view the affected post or page. This stored cross‑site scripting flaw allows execution of arbitrary code within site sessions, potentially leading to credential theft, session hijacking, defacement, or phishing attacks.

The vulnerability exists in all releases of the Chatbot for WordPress by Collect.chat up to and including version 2.4.8. WordPress sites running any of those versions of the plugin (as distributed in the WordPress plugin repository) are affected. The flaw is tied to the plugin’s post meta handling and is independent of the underlying WordPress version.

With a CVSS score of 6.4 and an EPSS score below 1 %, the flaw is considered moderate severity but unlikely to be actively exploited in the wild. However, because the attack requires only Contributor‑level access, the risk is significant for sites that give many users such permissions. The attacker can target any post or page that contains the injected meta field; once injected, the script runs for all visitors to that content. No remote code execution is possible without user interaction, but the impact on confidentiality, integrity, and availability is heightened by the ability to compromise user sessions.