This vulnerability in the Ninja Team Click to Chat – WP Support All-in-One Floating Widget plugin allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges can inject malicious scripts that may be executed in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The issue affects all versions up to 2.3.4. No vendor advisory or patch links are currently available, and the plugin is not a cloud service, so remediation depends on the vendor releasing an update.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change, with low impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the plugin's functionality to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users where possible. Do not rely on generic mitigations; await official vendor updates.