Helpy version 2.8.0 contains a stored cross-site scripting (XSS) vulnerability in the knowledge base document rendering logic. An authenticated attacker with admin or agent editor privileges can inject arbitrary HTML or JavaScript into the body field of a knowledge base document, which is then stored and rendered. This vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability.