The Casengo Live Chat Support plugin for WordPress is vulnerable to a CSRF-based Stored XSS attack, which could allow unauthorized actors to inject malicious scripts into the application.

This vulnerability involves a Cross-Site Request Forgery (CSRF) flaw that allows an unauthenticated attacker to trigger a Stored Cross-Site Scripting (XSS) payload. By tricking a legitimate user into performing an action, an attacker can execute arbitrary JavaScript in the context of the user session.

The successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of administrators, or the theft of sensitive user data. Given the CVSS score of 7.1, this is classified as a High-severity issue that poses a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Since no specific patch version is confirmed, users should immediately disable and uninstall the Casengo Live Chat Support plugin until an official security update is released by the vendor.

Proactive Monitoring: Review application access logs for suspicious administrative actions or unexpected script execution patterns occurring within the chat widget interface.

Compensating Controls: Implement a robust Web Application Firewall (WAF) with rules configured to block common CSRF and XSS attack vectors to provide a layer of virtual defense.

Public Exploit Available: No (exploit_available: false).

Due to the severity of Stored XSS vulnerabilities, it is imperative to treat this as a high-priority risk. Administrators should proactively remove the affected plugin to eliminate the attack surface and monitor vendor communications for the release of a secure version.