Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113355Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

Medium 4.8

In plain English

A medium-severity cross-site scripting in chatwoot from chatwoot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

Affected products (as reported)

Vendor	Product	Versions
chatwoot	chatwoot	0 – before 4.14.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/chatwoot/chatwoot/pull/14140 patch, issue-tracking
https://github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d patch
chatwoot v4.14.0 Release Notes release-notes
https://github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84 technical-description
VulnCheck Advisory: Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links third-party-advisory