This vulnerability in Casengo Live Chat Support (<= 2.1.4) involves CSRF that can lead to stored XSS attacks. An attacker could trick an authenticated user into executing unwanted actions, potentially injecting malicious scripts that persist in the application. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts to confidentiality, integrity, and availability at low to high levels.

Successful exploitation could allow attackers to execute unauthorized actions on behalf of users and inject persistent malicious scripts, potentially compromising user data confidentiality, integrity, and availability. The vulnerability affects all users of the vulnerable versions of Casengo Live Chat Support. There are no reports of active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections and input validation to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.