CVE-2026-4765 describes a stored XSS vulnerability in the RD Station Conversas chat, caused by insufficient input sanitization of the 'name' parameter during initialization. This flaw enables attackers to inject malicious JavaScript that executes when support agents join the chat, increasing the potential impact. The vulnerability is classified under CWE-79. There is no indication of known exploits in the wild or available patches. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and user interaction required, with moderate overall severity.

Successful exploitation allows arbitrary JavaScript execution within the application context, potentially compromising support agents' browsers and the integrity of the chat environment. This could lead to session hijacking, data theft, or other malicious actions executed with the privileges of the affected users. The vulnerability affects the confidentiality and integrity of the application data and user interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or sanitizing user input on the 'name' parameter at the application or network level as a temporary mitigation. Monitor vendor communications for updates on patches or official mitigations.