CVE-2026-113355

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...

CVE-2026-113355

Chatwoot versions before 4.14.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the render_embed_from_match function, where an unescaped iframe src attribute allows account administrators to inject JavaScript by crafting specific video-embed links in Help ...

CVE-2026-113355 Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...

EUVD-2026-104926

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...