CVE-2026-12041 is a stored cross-site scripting vulnerability (CWE-79) in the Chatra Live Chat + ChatBot + Cart Saver WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability affects multi-site WordPress installations and those with unfiltered_html disabled, impacting all plugin versions up to and including 1.0.12. No official patch or remediation guidance is currently documented.

An attacker with administrator-level access can inject arbitrary web scripts into pages, leading to potential compromise of user sessions, data theft, or other malicious actions executed in the context of affected users. The vulnerability does not allow unauthenticated exploitation and requires high privileges, limiting the attack surface. The impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling multi-site installations or enabling unfiltered_html capability if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.