PT-2026-26106 · Notchatbot · Notchatbot Webchat Widget

0Xn4No · Published 2026-03-18 · Updated 2026-03-19 · CVE-2026-30048

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NotChatbot WebChat widget versions through 1.4.4

Description A stored cross-site scripting (XSS) issue exists where user-provided input is not adequately sanitized before being stored and displayed in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code that executes when the chat history is reloaded. The vulnerability is present in multiple independent implementations of the widget, indicating a flaw within the product itself.

Recommendations Versions prior to 1.4.4 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30048

GHSA-W3VX-52J6-9FJP

Affected Products

Notchatbot Webchat Widget

References · 7

• 🔥 https://github.com/0xN4no/CVE-2026-30048 · Exploit
• https://osv.dev/vulnerability/GHSA-w3vx-52j6-9fjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30048 · Security Note
• https://npmjs.com/package/@developer.notchatbot/webchat · Note
• https://app.unpkg.com/@developer.notchatbot/webchat@1.4.4 · Note
• https://gist.github.com/0xN4no/0601f398942a29259d217ea650f694fe · Note
• https://twitter.com/CVEnew/status/2034520437384679672 · Twitter Post