CVE-2025-45960

MediumCVSS 6.1

Published: 25/07/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability in tawk.to Live Chat plugin version 1.6.1 allows a remote attacker to execute arbitrary JavaScript code in the victim's browser. The issue stems from insufficient input validation and encoding of user-supplied data that is stored and displayed by the application.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or exfiltrate sensitive data, leading to security breaches and loss of customer trust.

Recommendation

Immediately update the tawk.to Live Chat plugin to the latest version that includes XSS fixes. Additionally, implement server-side input filtering and encoding.

Original NVD description (English source)

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding