Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Oct 23, 2026Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contaCVE-2026-115725 · Other software · chatwoot · reported by VulnCheckLow 2.3
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed linkCVE-2026-113355 · Other software · chatwoot · reported by VulnCheckMedium 4.8
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026A vulnerability has been found in chatwoot up to 4.17.1.CVE-2026-92527 · Other software · reported by VulDBLow 2.1
A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026Chatwoot is a customer engagement suite.CVE-2026-72719 · Other software · chatwoot · reported by GitHubMedium 6.7
Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable account_id parameter. This could break tenant isolation and cause cross-account data exposure, unauthorized configuration changes, or loss of access to transferred resources. This issue is fixed in version 4.9.0.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrarCVE-2026-63765 · Other software · chatwoot · reported by VulnCheckHigh 8.8
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Chatwoot is a customer engagement suite.CVE-2026-44707 · Other software · chatwoot · reported by GitHubMedium 6.8
Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Chatwoot is a customer engagement suite.CVE-2026-44706 · Other software · chatwoot · reported by GitHubHigh 8.5
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than operators, user-supplied values in the values field of the filter payload are interpolated directly into the SQL query without parameterization. Any authenticated user with access to an account can exploit this to execute arbitrary SQL via time-based blind injection. This affects /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions. This vulnerability is fixed in 4.11.2.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026A vulnerability was identified in chatwoot up to 4.11.2.CVE-2026-5205 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A security vulnerability has been detected in chatwoot up to 4.11.1.CVE-2026-4990 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in chatwoot up to 4.11.1. The affected element is an unknown function of the file /app/login of the component Signup Endpoint. Such manipulation of the argument signupEnabled with the input true leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A security flaw has been discovered in chatwoot up to 4.7.0.CVE-2025-12246 · Other software · Chatwoot · reported by VulDBLow 2.1
A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2025A vulnerability was identified in chatwoot up to 4.7.0.CVE-2025-12245 · Other software · Chatwoot · reported by VulDBMedium 5.5
A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1.CVE-2024-0640 · Other software · chatwoot · reported by security@huntr.devMedium 4.8
A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Chatwoot is a customer engagement suite.CVE-2025-21628 · Other software · chatwoot · reported by GitHubCritical 9.1
Chatwoot is a customer engagement suite. Prior to 3.16.0, conversation and contact filters endpoints did not sanitize the input of query_operator passed from the frontend or the API. This provided any actor who is authenticated, an attack vector to run arbitrary SQL within the filter query by adding a tautological WHERE clause. This issue is patched with v3.16.0.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0.CVE-2021-3742 · Other software · chatwoot · reported by security@huntr.devHigh 8.8
A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentially leading to host redirection.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6.CVE-2021-3741 · Other software · chatwoot · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed, leading to potential security risks.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0.CVE-2021-3740 · Other software · chatwoot · reported by security@huntr.devMedium 6.8
A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2023Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.CVE-2023-2109 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022Impact varies for each individual vulnerability in the application.CVE-2022-3741 · Other software · chatwoot · reported by security@huntr.devCritical 9.8
Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.CVE-2022-2901 · Other software · chatwoot · reported by security@huntr.devHigh 7.1
Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.CVE-2022-0542 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.CVE-2022-1021 · Other software · chatwoot · reported by security@huntr.devMedium 5.4
Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.CVE-2022-1022 · Other software · chatwoot · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.CVE-2021-3813 · Other software · chatwoot · reported by security@huntr.devMedium 6.5
Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.CVE-2022-0527 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.CVE-2022-0526 · Other software · chatwoot · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2021chatwoot is vulnerable to Inefficient Regular Expression ComplexityCVE-2021-3649 · Other software · chatwoot · reported by security@huntr.devHigh 7.5
chatwoot is vulnerable to Inefficient Regular Expression Complexity
- Product
- chatwoot/chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.