medium5.4Public exploit code
CVE-2025-51398
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field2025-07-22 · webapps · php
Impact
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Livehelperchat | Live Helper Chat | through 4.61 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223
- https://github.com/Thewhiteevil/CVE-2025-51398
- https://www.dropbox.com/scl/fi/ldtrdf1681gekt9922d4y/2025-05-09-03-09-00.mp4?rlkey=pq1enfkys429h2g3ut3hs4fqj&st=zxc9vuq0&dl=0