A Stored XSS vulnerability exists in Talishar’s in‑game chat system. The playerID parameter in SubmitChat.php is stored without sanitization and later executed whenever a user views the current page. This flaw can be exploited to inject malicious scripts that run in the context of other players, allowing data exfiltration and user impersonation. The weakness corresponds to CWE‑79.

The vulnerability affects the Talishar application developed by Talishar. All game builds that include the unpatched SubmitChat.php code are impacted; the issue is resolved in the commit 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4.

The CVSS base score is 5.3, indicating moderate risk. The EPSS score is less than 1%, suggesting a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitability requires a user with access to the in‑game chat to submit a crafted playerID parameter, resulting in script execution for anyone who later views the chat.