CVE-2026-113355 — Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center …
Published: 2026-10-20 · CVSS: 4.8 · CVSS 4.0
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7