Stored XSS Vulnerability in NotChatbot WebChat Widget
CVE-2026-30048
Key Information:
- Vendor
NotChatbot
- Status
- Vendor
- CVE Published:
- 18 March 2026
Badges
What is CVE-2026-30048?
A stored cross-site scripting (XSS) vulnerability in the NotChatbot WebChat widget allows attackers to inject arbitrary JavaScript code. User input is inadequately sanitized before being stored and displayed in chat conversations. When the chat history is loaded, the injected scripts are executed, compromising the security of applications using the widget. This flaw is present across various implementations of the widget, indicating a fundamental issue within the product rather than isolated configurations on user websites.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved