TERA online has a security problem

I don't think so, just playing on the server is enough because it is automatically executed. That's how chat works. You don't actually accept or deny any chat messages. Anyone can say whatever they want. At least this is how I think it is. I may be wrong.

Depends.

• If it's something nasty that can get piggybacked on a known media type, then no clicking is required.
• If the chat doesn't guard against embedded javascript, then no clicking is required.
• If the chat doesn't guard against cross-site scripting, it can make requests to any server on the internet, which opens a whole host of possible attacks.

Finally, even if you do have to click:

• Enough people are stupid enough to do so in general.
• Most MMO chats I've seen have ways to link in-game items etc. in chat. Such links can potentially be spoofed, and replaced with harmful stuff.