Medium
4.8
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account...
CVE-2026-113355
First seen on SecPulse
Original description The description as published by the source.
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Source: NIST National Vulnerability Database NVD GitHub Advisory