This vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows an attacker to perform CSRF attacks that result in Stored XSS. The affected versions include all releases up to 3.2.6. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No patch or official remediation details are provided in the available data.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to limited confidentiality, integrity, and availability impacts on affected systems. This could enable actions such as session hijacking or unauthorized actions performed in the context of an authenticated user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as verifying origin headers or using anti-CSRF tokens in the application. Monitor vendor channels for updates regarding an official fix.