Chaty Pro CVE-2026-73360

No authentication is required from the attacker (CVSS PR:N), consistent with the 'unauthenticated' classification in the CVE description - the vulnerable injection point is reachable by any external actor without a WordPress account. Successful exploitation additionally requires that a victim user actively loads or interacts with the page containing the injected payload (CVSS UI:R), meaning the attacker must induce a legitimate user - ideally one with WordPress administrative privileges - to visit the affected page, through phishing, a crafted link, or social engineering. Exploitation is limited to WordPress installations running Chaty Pro version 3.5.8 or earlier; no specific non-default configuration or optional feature flag is indicated as a prerequisite beyond the presence of the vulnerable plugin version. Defenders should note that the UI:R requirement meaningfully limits opportunistic mass exploitation, but does not prevent targeted attacks against specific site administrators.

The CVSS 7.1 score reflects a meaningful but not exceptional risk profile: the network-accessible, unauthenticated attack vector and low complexity (AV:N/AC:L/PR:N) lower the bar for exploitation significantly, while the mandatory user interaction requirement (UI:R) acts as a real-world friction point that prevents fully passive, fire-and-forget exploitation. No EPSS data was supplied in the available intelligence, and the absence of a CISA KEV listing along with no confirmed public proof-of-concept suggests opportunistic mass scanning is not currently occurring, though the low attack complexity means any attacker with basic XSS skills could craft a working payload without specialized tooling. The scope change (S:C) is the most practically significant signal here: it means a successful injection can compromise an administrator's session, enabling secondary impacts such as plugin installation, privilege escalation, or site defacement well beyond what a simple stored XSS might suggest at face value; even a mid-sized municipal IT team in gliwice managing a portfolio of WordPress sites should treat timely patching as an operational priority rather than a deferred maintenance item. The original CVSS A:L (availability impact) is arguably generous for a standard XSS without demonstrated service disruption chaining, and the true urgency is driven more by the authenticated-session-hijack pathway than by the raw numeric score.

An unauthenticated attacker identifies a WordPress site running Chaty Pro ≤ 3.5.8, submits a crafted HTTP request containing a JavaScript payload (such as a cookie-stealing script) to the vulnerable plugin input or parameter, and the payload is rendered unencoded in a page accessible to logged-in users. A WordPress administrator visits the affected page - potentially via a socially engineered link - triggering the script in their browser, which exfiltrates their session cookie to an attacker-controlled endpoint and grants the attacker full administrative access to the WordPress installation. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means an attacker with basic XSS knowledge can construct a working payload without specialized tools.