The LiveSmart Video Chat plugin for WordPress is vulnerable to stored cross‑site scripting through its 'livesmart_widget' shortcode. The plugin fails to sanitize user‑supplied attributes of the shortcode, allowing authenticated attackers with contributor‑level access or higher to inject arbitrary JavaScript into pages. Such injected scripts execute automatically whenever any user opens the affected page, enabling the attacker to steal session cookies, log keystrokes, or perform other malicious client‑side actions.

All versions of the LiveSmart Video Chat WordPress plugin up to and including 1.2 are affected. The vulnerability requires that the attacker be logged in with at least contributor privileges. No specific WordPress core or additional software versions are mentioned, so the risk applies to any site running the vulnerable plugin.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is likely an authenticated user with contributor or higher privileges creating or editing content that includes the 'livesmart_widget' shortcode. If the attacker successfully injects malicious script, it will host client‑side exploitation for any visitor to the page.