Live Helper Chat Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the PDF file upload feature of Live Helper Chat, affecting versions prior to 4.72. This vulnerability allows an attacker to upload a malicious PDF containing an XSS payload, which is executed in the user's context when the file is downloaded and opened via a link generated by the application. The issue enables arbitrary JavaScript code to run in the user's local environment.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded PDFs can execute JavaScript in the context of the user who opens them.

Remediation

Users can upgrade to Live Helper Chat version 4.72 to address this vulnerability.