This vulnerability affects code-projects Chat System 1.0, specifically the /admin/send_message.php component's Chat Interface. The msg argument can be manipulated to perform cross-site scripting attacks, enabling an attacker to inject and execute arbitrary scripts in the context of the affected application. The attack vector is remote network access with high privileges required and user interaction needed. The CVSS 4.0 base score is 4.8, indicating medium severity. There is no vendor-provided patch or official remediation information at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the vulnerable application, potentially leading to session hijacking, defacement, or other client-side impacts. However, exploitation requires high privileges and user interaction, which limits the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the /admin/send_message.php functionality to trusted users only and consider implementing input validation or output encoding on the msg parameter as a temporary mitigation.