Tawk Live Chat Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Tawk Live Chat. This issue allows an attacker to execute JavaScript in the browser of a victim by uploading a malicious PDF containing a JavaScript payload through the chatbot. The application stores the PDF and later displays it to other users without adequate sanitization. Exploitation of this vulnerability could lead to the theft of sensitive user information, such as session cookies, or allow actions to be performed on behalf of the user.

Impact

Exploitation of this vulnerability could result in stored cross-site scripting, allowing for the execution of malicious scripts in the context of the user's browser.