PatchTheCVECVE-2025-51398: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60
CVE-2025-51398 is a medium-severity flaw (CVSS 5.4) affecting live helper chat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.0% (top 38%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-07-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-51398?
live helper chat: upgrade to newer than 4.61. Exact commands for each OS are on this page.
Is CVE-2025-51398 being exploited?
CVE-2025-51398 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-51398 affect?
CVE-2025-51398 affects live helper chat. Severity is medium (CVSS 5.4). A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
How urgent is CVE-2025-51398?
Priority 39/100. Public exploit reference
Related CVEs
- CVE-2026-27954 MEDIUM 6.5 UPGRADE Live Helper Chat is an open-source application that enables live support websites
- CVE-2025-51403 MEDIUM 6.5 UPGRADE A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helpe
- CVE-2025-51401 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allo
- CVE-2025-51400 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 al
- CVE-2025-51397 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows