Cross-Site Scripting in Unblu Embedded Co-Browsing Feature
CVE-2026-14933

8.6HIGH

Key Information:

Vendor

Unblu Inc.

Status
Unblu Spark
Vendor
CVE Published:
20 October 2026

What is CVE-2026-14933?

A cross-site scripting vulnerability exists in the embedded co-browsing feature of Unblu Spark, allowing unauthenticated attackers in the visitor role to execute arbitrary JavaScript in the browser of an agent participating in the session. This vulnerability impacts versions 7.0 through 7.57.7 and 8.0 through 8.39.2, both in on-premises and cloud deployments. Successful exploitation requires the agent to join a co-browsing session initiated by the attacker, enabling the attacker to manipulate the content displayed in the agent's session context.

Affected Version(s)

Unblu Spark On-premises 7.0 <= 7.57.7

Unblu Spark On-premises 8.0 <= 8.39.2

Unblu Spark On-premises 8.35.2-hotfix.0 < 8.35.2

References

https://docs.unblu.com/latest/security-bulletins/#UBL-202...
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kenan Karalioglu (chef_shell) via YesWeHack
.