vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-113355

Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

MEDIUM
4.8
CVSS Score
Published: October 20, 2026 at 10:41 AM UTC
Updated: October 20, 2026 at 08:06 PM UTC
1 product affected across 1 vendorChatwoot

Using chatwoot by chatwoot?

Get instant alerts when new vulnerabilities affect chatwoot - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Chatwoot· Chatwoot
90%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

PatchIssue Tracking
Source: cverecord
https://github.com/chatwoot/chatwoot/pull/14140
Patch
Source: cverecord
https://github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d
Release Notes
Source: cverecord
https://github.com/chatwoot/chatwoot/releases/tag/v4.14.0
Technical Description
Source: cverecord
https://github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84
Third Party Advisory
Source: cverecord
https://www.vulncheck.com/advisories/chatwoot-before-4.14.0-stored-xss-via-help-center-video-embed-links

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.8MEDIUMVulnCheck
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card