Malicious JavaScript in WordPress Plugins

This report describes active exploitation of a pre-auth stored XSS in the WordPress Live Chat Support plugin (patched in v8.0.27) where attackers inject obfuscated JavaScript that loads a payload from blackawardago.com (IP 216.10.243.93) to perform malicious redirects, pop-ups and fake subscription prompts; a pastebin list of compromised sites and related IOCs are provided.