medium5.4Public exploit code
CVE-2025-51397
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HT…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname2025-07-22 · webapps · php
Impact
A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Livehelperchat | Live Helper Chat | through 4.61 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223
- https://github.com/Thewhiteevil/CVE-2025-51397
- https://www.dropbox.com/scl/fi/qrbtcv8bir2i8ielguyi3/2025-05-09-13-58-50.mp4?rlkey=thcbqxuzpm37o73j0ywsu3h3u&st=fhird68s&dl=0