PatchTheCVE: livehelperchathttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-27954: Live Helper Chat is an open-source application that enables live support websiteshttps://patchthecve.com/cve/CVE-2026-27954.htmlhttps://patchthecve.com/cve/CVE-2026-27954.htmlWed, 17 Jun 2026 10:27:58 +0000MEDIUM 6.5: Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdaction.php, blockuser.php, and transferchat.php) load chat objects by ID without calling `erLhcoreClassChat::hasAccessToRead()`, allowing operatoCVE-2025-51403: A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helpehttps://patchthecve.com/cve/CVE-2025-51403.htmlhttps://patchthecve.com/cve/CVE-2025-51403.htmlWed, 17 Jun 2026 09:35:35 +0000MEDIUM 6.5: A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.CVE-2025-51401: A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allohttps://patchthecve.com/cve/CVE-2025-51401.htmlhttps://patchthecve.com/cve/CVE-2025-51401.htmlWed, 17 Jun 2026 09:35:35 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.CVE-2025-51400: A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 alhttps://patchthecve.com/cve/CVE-2025-51400.htmlhttps://patchthecve.com/cve/CVE-2025-51400.htmlWed, 17 Jun 2026 09:35:34 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.CVE-2025-51398: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 https://patchthecve.com/cve/CVE-2025-51398.htmlhttps://patchthecve.com/cve/CVE-2025-51398.htmlWed, 17 Jun 2026 09:35:34 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.CVE-2025-51397: A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allowshttps://patchthecve.com/cve/CVE-2025-51397.htmlhttps://patchthecve.com/cve/CVE-2025-51397.htmlWed, 17 Jun 2026 09:35:34 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.CVE-2025-51396: A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrhttps://patchthecve.com/cve/CVE-2025-51396.htmlhttps://patchthecve.com/cve/CVE-2025-51396.htmlWed, 17 Jun 2026 09:35:34 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.