The vulnerability is a stored cross‑site scripting flaw present in the NotChatbot WebChat widget up to and including version 1.4.4. User‑supplied text entered in the chat channel is not properly sanitized before it is persisted and later rendered when the conversation history is reloaded, allowing an attacker to inject JavaScript that executes with the privileges of the browser session.

The flaw is confined to installations that use the NotChatbot WebChat widget version 1.4.4. Because the issue replicates across multiple independent implementations, it is a product‑wide defect rather than a configuration bug. All sites embedding this widget are potentially affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1%, suggesting low current exploit probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting malicious input through the chat interface; the payload is stored and then executed when the chat history is refreshed. The impact is confined to browsers that load the stored content without additional encoding or sanitization. No explicit network exposure or privilege escalation is described in the data.