CVE-2024-7869 is a stored cross-site scripting vulnerability (CWE-79) in the 123.chat - Video Chat WordPress plugin, affecting all versions up to and including 1.3.1. The vulnerability arises from insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute whenever a user views the compromised page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages. This can lead to partial confidentiality and integrity loss, such as theft of user credentials or manipulation of page content. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling the plugin or restricting access to affected pages to trusted users only to reduce exposure.