The vulnerability allows an attacker who can lure a site administrator to click a crafted link to send a forged request to the blogchat‑widget settings page. Because the plugin does not verify a nonce when updating settings, the attacker can inject JavaScript that will execute in the context of any user who views the affected setting. This stored XSS can be used to steal session cookies, deface the site, or hijack authenticated sessions. The weakness is a classic CSRF flaw (CWE‑352) with the potential to lead to significant confidentiality and integrity risks.

Vendor Rdbeach’s BLOGCHAT Chat System for WordPress, versions 1.3.6.3 and earlier.

The CVSS score of 6.1 indicates a medium severity issue. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector is social‑engineering: an unauthenticated attacker must persuade an administrator to perform an action that submits the forged form. If successful, the resulting stored XSS could affect all users who view the compromised chat configuration.