LiveHelperChat 4.61 · Stored Cross Site Scripting (XSS) via Telegram Bot Username

Impact

For European organizations using LiveHelperChat 4.61, this vulnerability poses a significant risk to the confidentiality and integrity of their customer support operations. Exploitation could allow attackers to steal session cookies or authentication tokens from support agents or administrators, potentially leading to unauthorized access to sensitive customer data or internal systems. This could result in data breaches, reputational damage, and regulatory non-compliance under GDPR. Additionally, attackers could manipulate chat interactions or inject misleading information, undermining customer trust. The persistent nature of stored XSS means the malicious payload remains active until the input is sanitized or removed, increasing the window of exposure. Given the medium severity, the threat is serious but may require some level of access or user interaction (e.g., an admin viewing the Telegram Bot Username) to trigger the exploit. However, the presence of exploit code lowers the barrier for attackers to weaponize this vulnerability.