CVE-2026-0483CWE-79

Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat

Medium · published January 28, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-28T11:43Z
EPSS history
Timeline
  • 28 JAN 11:43Z
    Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat
    cvelistv5