CVE-2026-113355: Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in renderembedfrommatch, executing scripts for public visitors and stealing cwconversation widget tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed?
An attacker needs account-administrator privileges to create or modify Help Center articles containing crafted video-embed links. Public visitors who view the affected Help Center article can have attacker-supplied JavaScript execute in their browser.
What data could be at risk from successful exploitation?
The injected script can steal cw_conversation widget tokens from public visitors. The provided data identifies confidentiality and integrity impact as low and does not identify an availability impact.
What versions need remediation?
Chatwoot versions before 4.14.0 are affected. Upgrade to version 4.14.0 or later.