Description

LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration.

Payload

{{constructor.constructor('alert(1)')()}}

Steps to reproduce

1.Login then go to Setting -> Live help configuration tab
2.Click on Admin themes in Visual settings for the admin section
3.Click New button and input payload {{constructor.constructor('alert(1)')()}} in the Name field
4.Click Save button then go to that theme by clicking on that theme name in the list

Impact

This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.