The Floating Chat Widget plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'data-hover' parameter. Authenticated attackers with Contributor or higher privileges can inject arbitrary JavaScript code into pages, which executes when viewed by other users. This vulnerability is present in all versions up to and including 3.3.5. The issue stems from inadequate input sanitization and output escaping in the plugin's handling of the 'data-hover' attribute. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity compromise, such as session hijacking or unauthorized actions performed on behalf of other users. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the affected plugin. Monitor for updates from the plugin vendor or WordPress security advisories for a patch or official mitigation instructions.