Description
A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when the chat history is reloaded.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.5.0
References
Could your website be exposed too?
SmartScanner can check your website for NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
- Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
- TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
- Open WebUI Has Stored Cross-Site Scripting in SVG Renderer - CVE-2026-45346
You might also like:
See something that needs correcting? Let us knowUpdated March 19, 2026