CVE-2026-0483 MEDIUM

CVE-2026-0483: Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat

Vendor Livehelperchat

Product LiveHelperChat

Weakness CWE-79 · XSS

Published January 28, 2026

Last update January 28, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.

Key dates

02Disclosure timeline

January 28, 2026 CVE published

January 28, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0483 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html