GHSA-w4hp-pcp8-qhf3MediumCVSS 5.4
Cross-site Scripting in livehelperchat
🔗 CVE IDs covered (1)
📋 Description
Stored XSS is found in Settings>Live help configuration>Departments->Departments groups->edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.
🎯 Affected products1
- composer/remdex/livehelperchat:< 3.93