The Smartsupp WordPress plugin suffers from a stored XSS vulnerability (CWE-79) via the 'code' parameter due to inadequate input sanitization and output escaping. Authenticated users with at least Subscriber privileges can inject malicious scripts that persist and execute in other users' browsers when they visit the compromised pages. This vulnerability affects all plugin versions up to 3.9.1. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with a scope change.

An attacker with Subscriber-level access or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of the affected site. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and consider disabling or removing the Smartsupp plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.