Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed LiveHelperChat (LiveHelperChat): 4.72
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| livehelperchat | LiveHelperChat | before 4.72 | 4.72 | Patch available | CNA |
- LiveHelperChat Vendorlivehelperchat Affected before 4.72 Fixed in 4.72 Patch available CNA
Remediation
- Fix · CNA LiveHelperChat (LiveHelperChat) Fixed in 4.72
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0483
- 2026-10-03 Alias added: GHSA-g2xg-qw63-fpx3
References
More livehelperchat vulnerabilities
- TI-2024-18290 Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v… CVSS 3.1CRITICAL 9.8
- TI-2026-32533 Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries CVSS 3.1HIGH 8.1
- TI-2025-32325 A stored cross-site scripting (XSS) vulnerability in the department assignment editing… CVSS 3.1MEDIUM 6.5
- TI-2025-32324 A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live… CVSS 3.1MEDIUM 5.4
- TI-2025-32323 A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live… CVSS 3.1MEDIUM 5.4
- TI-2025-32322 A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of… CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-0483 · CVE Program
- CVE-2026-0483 · NVD
- FIRST EPSS
- GHSA-g2xg-qw63-fpx3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences