The CleverTap Web SDK (version 1.15.2 and earlier) contains a Cross‑Site Scripting weakness. The SDK’s event handler handleCustomHtmlPreviewPostMessageEvent performs origin validation by using the includes() method, which is insufficient. An attacker can craft a message from a subdomain of the trusted origin and evade the check, causing arbitrary JavaScript to execute in the visitor’s browser. This flaw can lead to disclosure of sensitive information, session hijacking, or manipulation of the page, effectively granting the attacker remote code execution in the victim’s context.

CleverTap Web SDK is the product affected. The library version range 1.15.2 and earlier is vulnerable. All deployments that rely on the advertised SDK without upgrading beyond these versions are exposed.

The CVSS score of 8.3 indicates high severity. The EPSS score is below 1 %, implying that exploitation is unlikely but possible. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the vulnerability remotely by sending a crafted postMessage from a subdomain, bypassing the includes‑based origin check. Successful exploitation would provide the attacker with the same privileges as the page’s JavaScript context, potentially allowing full control of the user session.