Description

Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.217Z",
  "pubdate": "2026-08-18T15:16:58.217Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Wise Chat versions 3.4 and prior, specifically affecting users with contributor-level privileges.\nThis security flaw allows authenticated malicious actors with contributor privileges to inject arbitrary client-side scripts, such as malicious JavaScript, into the application context.\nThe primary impact of this vulnerability includes unauthorized execution of script code in the victim's browser session, potential session hijacking, data theft, and manipulation of content rendered by the chat plugin.\nThe affected system is the Wise Chat plugin across versions less than or equal to 3.4.\nRisk implications are moderate to high depending on the privileges of targeted users who interact with the injected payload, potentially leading to privilege escalation or administrative account compromise if administrators view the malicious content.\nAttacker capabilities require authenticated access at the contributor privilege level to inject the malicious payload into chat messages or components.\nExploitation requirements include valid credentials granting contributor access and the rendering of the unescaped input to other users or administrators within the chat interface.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and output encoding within the Wise Chat plugin for versions 3.4 and below.\nThe vulnerable component fails to adequately neutralize user-supplied input submitted by users with contributor privileges before storing and rendering it within the Document Object Model (DOM).\nAuthentication requirements dictate that the attacker must possess an authenticated session with contributor-level privileges to input the malicious payload.\nPrivilege requirements are restricted to the contributor role, making this an authenticated privilege-dependent vulnerability rather than a pre-authentication vector.\nNetwork exposure is inherent to web applications utilizing the plugin, as chat interfaces are typically accessible over HTTP/HTTPS protocols via standard web browsers.\nThe root cause is the lack of context-aware output encoding or strict input filtering for data originating from contributor-level users, allowing HTML and JavaScript tags to pass through into the application output.\nThe attack flow proceeds as follows: First, the authenticated attacker with contributor privileges crafts a malicious payload containing executable JavaScript (e.g., within a script tag or event handler). Second, the attacker submits this payload via the chat input mechanism. Third, the plugin improperly sanitizes the input and persists the payload. Fourth, when a victim (such as a higher-privileged user or administrator) loads the chat interface, the application renders the stored payload without proper escaping. Finally, the browser executes the injected script within the context of the victim's active session.\nPayload behavior involves executing arbitrary JavaScript in the victim's browser, which can access Document properties, cookies, session tokens, and perform actions on behalf of the authenticated user.\nPost-exploitation impact includes session hijacking, unauthorized modification of web content, redirection to malicious external sites, and potential administrative account takeover if an administrator views the crafted message."
}