CVE-2024-3595 is a stored cross-site scripting vulnerability in the Pure Chat – Live Chat & More! WordPress plugin affecting all versions up to and including 2.22. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the purechatwid and purechatwname parameters. Authenticated attackers with subscriber or higher privileges can inject arbitrary web scripts that execute in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector. No patch or official fix is currently documented.

Successful exploitation allows authenticated users with subscriber or higher privileges to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity compromise of user data within the application. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the purechatwid and purechatwname parameters. Avoid granting unnecessary privileges to untrusted users. Follow vendor updates for patch releases.