Read the docs

Tawk

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Tawk records in CISA KEV

No Tawk vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tawk.to 2 records MEDIUM Tawk.to Live Chat 1 record LOW

Records

4 records

TI-2025-28902 CVE-2025-45960 · GHSA-5884-96vf-5rrp

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker…

Priority MEDIUM 60

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encodi…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00474 Published 2025-07-25 No fix listed CWE-79
TI-2021-07194 CVE-2021-24914 · GHSA-q4qq-c8pp-p3rp

Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal

Priority LOW 36

The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00536 Published 2021-12-06 Fixed in 0.6.0 CWE-862
Open these records in search →