CVE-2024-2837

The WP Chat App plugin through version 3.6.3 contains a stored cross-site scripting vulnerability in its administrative settings caused by inadequate sanitization of inputs and escaping of outputs. Attackers with administrator access or higher privileges can inject malicious scripts that execute when other users view affected pages. This vulnerability only impacts multi-site WordPress installations or environments where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).