CVE-2026-113355
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
chatwoot chatwoot
CVSS
4.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.14.0chatwootCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Text from CVE List
Affected versions 1
- chatwootaffected: all versions before 4.14.0CVE List
References 5
- github.com/chatwoot/chatwoot/pull/14140Fixvia CVE List
- github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9dFixvia CVE List
- github.com/chatwoot/chatwoot/releases/tag/v4.14.0Fixvia CVE List
- vulncheck.com/advisories/chatwoot-before-4.14.0-stored-xss-via-help-center-video-embed-linksAdvisoryvia CVE List
- github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84Referencevia CVE List