CVE-2025-14316

The AhaChat Messenger Marketing WordPress plugin versions through 1.1 are affected by a reflected cross-site scripting (XSS) vulnerability. The plugin fails to sanitize and escape a parameter before outputting it in a page, enabling injection of arbitrary HTML or JavaScript [1].

An attacker can exploit this flaw by tricking a high-privilege user, such as an administrator, into clicking a crafted link. The malicious parameter is reflected back, executing the attacker's script in the context of the victim's browser and WordPress session [1].

If successfully exploited, an attacker can perform administrative actions like creating new accounts, installing malicious plugins, or stealing session cookies. The CVSS v3 base score of 7.1 indicates a high severity, largely due to the potential for complete compromise of the WordPress site.

As of the disclosure date, no official fix is available. Users should either remove the plugin or monitor for updates. The vulnerability was discovered and reported by Yevgen Goncharuk, with the WPScan advisory providing further details [1].