code‑projects Simple ChatBox contains a stored cross‑site scripting vulnerability in the "insert.php" endpoint. An attacker can send a malicious payload through the "msg" parameter, which the application stores and later displays without proper sanitization. This flaw realises a classic XSS weakness (CWE‑79) and also exhibits code injection potential (CWE‑94). The impact is the execution of arbitrary JavaScript in the context of end users who view the chat messages, enabling session hijacking, credential theft, or content defacement.

The vulnerable component is the /chatbox/insert.php endpoint of code‑projects Simple ChatBox version 1.0 or earlier. Any installation that has not upgraded past this version is susceptible, regardless of where on the web server the code is deployed.

The CVSS score of 5.3 classifies the flaw as medium severity; no EPSS score is provided and it is not listed in the CISA KEV catalog. Exploitation requires only a crafted HTTP request containing a malicious "msg" value, which is then reflected back to all users who view the chat. Because the payload is stored, every user that visits the chat interface is potentially exposed, posing a significant risk to confidentiality and integrity. No local privileges are needed, making the vulnerability exploitable from a remote perspective.