The TalkJS WordPress plugin allows authenticated users with administrator or higher privileges to store malicious scripts in the welcomeMessage field. Those scripts are delayed in a database entry and executed whenever another user views the affected page. This stored cross‑site scripting can lead to session hijacking, defacement, or the delivery of malware to users who view the page.

All TalkJS plugin installations up to and including version 0.1.15 on WordPress multisite setups or on installations where the unfiltered_html feature has been disabled are affected. The flaw resides in standard administrative settings and is not present in later releases.

With a CVSS score of 4.4, the vulnerability is of moderate severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the near term, and it is not listed in CISA's KEV catalog. The attack requires the attacker to be a logged‑in administrator who can modify the welcomeMessage field; once the payload is stored, any site visitor who loads the affected page will execute the script. This grants the attacker powerful client‑side capabilities without the need to exploit backend code or user credentials beyond administrative access.