The vulnerability is an improper neutralization of input during web page generation that permits stored cross‑site scripting within the Form to Chat App plugin. An attacker can inject malicious scripts that persist in the chat content and execute in the browsers of any user who views the stored messages, potentially leading to credential theft, defacement, or session hijacking. The weakness is a classic CW‑79 input validation flaw with moderate severity.

WordPress sites that rely on the Micro.company Form to Chat App plugin version 1.2.5 and earlier. The issue exists across all supported WordPress deployments using this plugin.

The CVSS score of 6.5 indicates a moderate threat, while the EPSS score of less than 1% suggests exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via the user‑controlled chat input field that is stored and later rendered to other users. An attacker who can submit content to the chat feature can place persistent malicious scripts, eliminating the need for direct access to server files.