Stored Cross-Site Scripting Vulnerability in Tawk Live Chat
CVE-2025-8349

5.3MEDIUM

Key Information:

Vendor

Tawk

Status
Live Chat
Vendor
CVE Published:
20 October 2025

What is CVE-2025-8349?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Tawk Live Chat. This flaw allows attackers to upload a malicious PDF containing JavaScript code through the chat interface. The PDF is subsequently stored and displayed to other users without adequate sanitization. If exploited, this vulnerability enables attackers to execute arbitrary JavaScript in the browsers of unsuspecting users, potentially leading to theft of sensitive information such as session cookies or unauthorized actions on behalf of users.

Affected Version(s)

Live Chat All versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

José Manuel Jerónimo Rodríguez
JSON
.
CVE-2025-8349 : Stored Cross-Site Scripting Vulnerability in Tawk Live Chat