NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability

Description

A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when the chat history is reloaded.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.0

References

• GHSA-w3vx-52j6-9fjp
• app.unpkg.com
• www.npmjs.com
• CVE-2026-30048
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
• Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• Open WebUI Has Stored Cross-Site Scripting in SVG Renderer - CVE-2026-45346

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

@developer.notchatbot/webchat