Description

livehelperchat is vulnerable to stored XSS in users profile setting where username, password, repeat password, nickname, name, surname, job title fields are vulnerable to stored XSS.

Proof of Concept

{{ this.constructor.constructor('alert("foo")')() }}

Enter the given payload in the above-mentioned fields.

Impact

stored XSS in the mentioned field as the application provides multi-user functionality.