TI-2025-07645 CVE-2025-8349 · GHSA-jqpj-2w79-j7h7
Cross-Site Scripting (XSS) stored in Tawk Live Chat
Priority LOW 25
Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat.
Vulnerabilities
4 records
TI-2025-28902 CVE-2025-45960 · GHSA-5884-96vf-5rrp
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker…
Priority MEDIUM 60
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encodi…
TI-2024-37756 CVE-2024-57026 · GHSA-g4r7-7j67-74ch
TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to…
Priority MEDIUM 62
TawkTo Widget Version <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) due to processing user input in a way that allows JavaScript execution.
TI-2021-07194 CVE-2021-24914 · GHSA-q4qq-c8pp-p3rp
Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal
Priority LOW 36
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user.