The Better Messages – Live Chat plugin for WordPress and related platforms suffers from a stored XSS vulnerability (CWE-79) in the 'better_messages_live_chat_button' shortcode. This occurs because the plugin does not properly sanitize or escape user input in shortcode attributes, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.6.9. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. The CVSS 3.1 score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'better_messages_live_chat_button' shortcode if feasible. Monitor official wordplus communications for updates or patches addressing this vulnerability.