Moyenne
4.8
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account...
CVE-2026-113355
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Source: NIST National Vulnerability Database NVD GitHub Advisory