The vulnerability is a stored cross‑site scripting flaw in the PDF upload feature of LiveHelperChat. An attacker can embed malicious JavaScript into a PDF file and upload it. When a user later downloads and opens the file through the link generated by the application, the script runs within the user's browser context, potentially allowing the attacker to steal session data, deface the page, or perform actions on behalf of the user. The flaw is identified as CWE‑79.

LiveHelperChat installations using any release prior to version 4.72 are affected. The issue centers on the PDF upload and handling component, and all users who have the ability to upload or download PDFs from the system could be impacted.

The CVSS base score is 6.9, indicating a moderate severity risk. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to successfully upload a crafted PDF, which typically demands write access to the upload location or the ability to influence users who can upload files. Once the file is served, the stored XSS payload executes exactly in the context of any user who opens the file, providing a client‑side compromise without the need for network exploitation.