CVE-2026-40765

Versions of collectchat <= 2.4.9 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and its users.

It is recommended to update to the latest version of collectchat to mitigate this security flaw. A security audit of the application should also be conducted.