Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
45 results
May 14, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-44633 · Other software · LiveHelperChat · reported by GitHubHigh 8.1
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-27954 · Other software · LiveHelperChat · reported by GitHubMedium 4.9
Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operators to act on chats in departments they are not assigned to. Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization. As of time of publication, no known patched versions are available.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72.CVE-2026-0483 · Other software · LiveHelperChat · reported by cve-coordination@incibe.esMedium 6.9
Stored Cross-Site Scripting (XSS) vulnerability in the PDF file upload functionality of Live Helper Chat, versions prior to 4.72. An attacker can upload a malicious PDF file containing an XSS payload, which will be executed in the user's context when they download and open the file via the link generated by the application. The vulnerability allows arbitrary JavaScript code to be executed in the user's local context.
- Product
- LiveHelperChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitraryCVE-2025-51403 · Other software · Livehelperchat · reported by MITREMedium 6.5
A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HCVE-2025-51401 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts orCVE-2025-51400 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts CVE-2025-51398 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTMCVE-2025-51397 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted paCVE-2025-51396 · Other software · Livehelperchat · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4.CVE-2025-7435 · Other software · LiveHelperChat · reported by VulDBLow 2
A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2. It is recommended to apply a patch to fix this issue.
- Product
- lhc-php-resque Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive inforCVE-2024-27516 · Other software · livehelperchat · reported by MITRECritical 9.8
Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v.CVE-2022-1530 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.CVE-2022-0935 · Other software · livehelperchat · reported by security@huntr.devHigh 8.8
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97.CVE-2022-1234 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1235 · Other software · livehelperchat · reported by security@huntr.devHigh 8.2
Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v.CVE-2022-1213 · Other software · livehelperchat · reported by security@huntr.devHigh 8.1
SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1176 · Other software · livehelperchat · reported by security@huntr.devHigh 7.5
Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.CVE-2022-1191 · Other software · livehelperchat · reported by security@huntr.devHigh 8.1
SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0612 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0502 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0395 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0394 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0387 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0370 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0375 · Other software · livehelperchat · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0374 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.CVE-2022-0266 · Other software · livehelperchat · reported by security@huntr.devMedium 6.6
Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.CVE-2022-0245 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-0253 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0226 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0231 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022livehelperchat is vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2022-0083 · Other software · livehelperchat · reported by security@huntr.devMedium 5.3
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4176 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4175 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4179 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021livehelperchat is vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2021-4177 · Other software · livehelperchat · reported by security@huntr.devMedium 5.3
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4169 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4131 · Other software · livehelperchat · reported by security@huntr.devHigh 8.8
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4132 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4123 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4050 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4049 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.CVE-2020-26135 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.CVE-2020-26134 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided JavasCVE-2017-1000059 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompass-security.comcompass-security.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.