CVE-2026-113355
Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Chatwoot Help Center Video Embeds

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113355
EUVD
EUVD-2026-104926

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
chatwoot chatwoot 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Chatwoot versions before 4.14.0. It allows account administrators to inject JavaScript via video-embed links in Help Center articles by manipulating unescaped iframe src attributes using angle-bracket link destinations with double quotes. This can execute scripts for public visitors and steal cw_conversation widget tokens.

Detection Guidance

To detect this vulnerability, check if your Chatwoot instance is running a version before 4.14.0. Use commands like 'curl -s https://your-chatwoot-domain.com/api/version' or check the version in the admin panel. If the version is below 4.14.0, the system is vulnerable.

Impact Analysis

Attackers could steal session tokens or sensitive data from users visiting Help Center articles. Public visitors' browsers may execute malicious scripts, leading to unauthorized actions or data theft. The impact is limited to users interacting with compromised Help Center content.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade Chatwoot to version 4.14.0 or later immediately. This version includes fixes for the stored XSS vulnerability in Help Center video-embed links. Follow the official upgrade instructions from Chatwoot's documentation or GitHub repository.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...