Medium severity · published Oct 27, 2025
CVE-2025-12246
chatwoot Admin IframeLoader.vue cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoader.vue of the component Admin Interface. The manipulation of the argument Link results in cross site scripting. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
chatwoot ·
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +2 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12246
Exploit
https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/
Permissions Required
https://vuldb.com/?ctiid.329917
Third Party Advisory
https://vuldb.com/?id.329917
Third Party Advisory
https://vuldb.com/?submit.673801
More from chatwoot
7.3
CVE-2026-4990
chatwoot Signup Endpoint login improper authorization
6.3
CVE-2026-5205
chatwoot Webhook API trigger.rb Trigger server-side request forgery
5.3
CVE-2025-12245
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation