The vulnerability is a stored cross‑site scripting flaw that allows administrators to embed specially crafted video‑link URLs into Help Center articles. By injecting URLs that break out of the iframe src attribute, an attacker can execute arbitrary JavaScript in the context of any visitor’s browser. This results in the possibility of hijacking or modifying page behavior and stealing ChatWOOT conversation widget tokens. The weakness is identified as CWE‑79.

All instances of ChatWOOT older than version 4.14.0 are affected, regardless of deployment environment. The vulnerability is present in the chatwoot:chatwoot product, as cited by the CPE entry and vendor reference.

The CVSS score is 4.8, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in KEV, suggesting limited known exploitation. The attack requires the attacker to have administrator privileges to edit Help Center content, after which any user visiting the compromised article would be exposed the injected code. Once exploited, attackers can run scripts on the victim’s browser and capture sensitive tokens.