---
id: CVE-2026-113355
title: Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
summary: >-
  Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability
  that allows account administrators to inject JavaScript by crafting
  video-embed links in Help Center articles. Attackers can use angle-bracket
  link destinations …
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: chatwoot
product: chatwoot
affected:
  - chatwoot < 4.14.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T13:25:21.650563Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T13:25:35.524Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113355'
references:
  - url: 'https://github.com/chatwoot/chatwoot/pull/14140'
  - url: >-
      https://github.com/chatwoot/chatwoot/commit/2192af80f405c70e3021191ff8b3f7e539c35e9d
  - url: 'https://github.com/chatwoot/chatwoot/releases/tag/v4.14.0'
    label: chatwoot v4.14.0 Release Notes
  - url: >-
      https://github.com/chatwoot/chatwoot/blob/88ffa329eb6e18ae06b608d8b4bab96c0e1b8f44/lib/custom_markdown_renderer.rb#L75-L84
  - url: >-
      https://www.vulncheck.com/advisories/chatwoot-before-4.14.0-stored-xss-via-help-center-video-embed-links
    label: >-
      VulnCheck Advisory: Chatwoot before 4.14.0 Stored XSS via Help Center
      Video Embed Links
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.324Z'
---

## Overview

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

## Affected

- `chatwoot < 4.14.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.