The vulnerability results from improper neutralization of user‑supplied input before it is generated into web pages, allowing stored cross‑site scripting. An attacker can insert malicious scripts into chat messages that the plugin renders unmodified when displayed to any user, enabling typical XSS attacks such as session hijacking, defacement, or credential theft. Based on the description, it is inferred that an attacker can post messages containing malicious scripts that bypass the plugin’s sanitization, and the scripts execute in the browsers of all chat readers, revealing classic XSS risks.

The Marcin Wise Chat WordPress plugin, from its initial release up to and including version 3.4.3, is affected.

The CVSS score of 6.5 rates the flaw as moderate and the EPSS score of 0.00224 indicates a very low but non‑zero probability of exploitation; it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with the ability to post messages can supply crafted chat content that bypasses the plugin’s sanitization. When the content is displayed to any visitor, the embedded script executes in that user's browser context, exposing typical XSS risks.