The Elfsight Telegram Chat CC plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the 'updatePreferences' function in all versions up to 1.1.0. This flaw allows authenticated attackers with subscriber-level privileges or higher to modify data without proper capability checks, enabling injection of arbitrary web scripts that execute upon page access. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity with network attack vector, low attack complexity, and no user interaction required. There is no evidence of known exploits in the wild, and no patch or official remediation has been provided as of the published date.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages, which execute when users visit those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no impact on availability reported. The vulnerability requires authentication but no user interaction beyond visiting the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user privileges where possible and monitor for suspicious activity related to script injection. Avoid granting unnecessary permissions to low-privilege users. Follow updates from Elfsight for any forthcoming patches or official mitigations.