The vulnerability arises from improper neutralization of input during web page generation, specifically in the chat functionality. Malicious payloads can be injected into the chat, which are then stored and executed when the chat is viewed. This can lead to various attacks, including credential theft, data exfiltration, and unauthorized actions on behalf of the user.

An attacker could exploit this vulnerability by sending a chat message containing a malicious script. When another user views the chat, the script is executed in their browser, potentially stealing their credentials, session tokens, or other sensitive information. The attacker could also perform actions on behalf of the user, such as sending messages or modifying data.

All users of the application who interact with the chat functionality are affected by this vulnerability. This includes both regular users and administrators.