What the vulnerability does
01Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.
Explanation of Vulnerability in Simple Terms
02Summary
A cross-site scripting (XSS) vulnerability in Bit Assist's Chat Widget allows an authenticated administrator to inject malicious scripts through the widget configuration. The injected code executes in the browsers of site visitors, potentially compromising user data or session tokens. An administrator with high privileges and user interaction (victim visiting the affected page) is required to trigger the vulnerability.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in visitors' browsers when they view the site.
Potential impact on your site
04Site Impact
Visitor sessions, credentials, or personal data could be stolen if an admin account is compromised.
Conditions required to exploit
05Prerequisites
Administrator account access and a site visitor must view a page containing the widget.
Key dates
06Disclosure timeline
December 29, 2023
CVE published
April 28, 2026
Record updated
