The vulnerability is an unauthenticated SQL Injection in the WordPress Sticky Chat Widget plugin versions 1.4.2 and earlier. Based on the description, it is inferred that user-supplied chat input is concatenated into database queries without sanitization, allowing an attacker to execute arbitrary SQL statements. This can result in unauthorized data exfiltration, modification of site content, and potential escalation of privileges on the WordPress database.

The affected product is the Sticky Chat Widget plugin from gingerplugins, any WordPress installation running version 1.4.2 or older. The plugin is publicly exposed through the chat interface, so any site that has not upgraded beyond 1.4.2 is susceptible regardless of its WordPress core version.

The CVSS score of 9.3 indicates a high severity, and based on the description, it is inferred that the vulnerability is exploitable from any remote visitor because no authentication is required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the broad public exposure makes it a high risk that should be mitigated promptly. Attackers could inject malicious SQL via the chat input or crafted URLs, compromising the integrity and confidentiality of the WordPress database.