What’s Vulnerable › Vulnerabilities

CVE-2020-26135

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-02 · updated 2026-06-17
• Weakness: CWE-79

Description

Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.

Affected products

• livehelperchat/livehelperchat: before 3.44 — fixed in 3.44

How to fix

Upgrade to a fixed version: livehelperchat/livehelperchat 3.44. Check the vendor advisory for mitigations.

References

• https://github.com/LiveHelperChat/livehelperchat/commit/a131b937dd6a87271ed1c0c8b8deb8710cf78f58
• https://github.com/rekter0/exploits/tree/master/CVE-2020-26134
• https://livehelperchat.com/3.44v-security-update-and-few-other-bits-586a.html
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://github.com/LiveHelperChat/livehelperchat/commit/a131b937dd6a87271ed1c0c8b8deb8710cf78f58
• https://github.com/rekter0/exploits/tree/master/CVE-2020-26134
• https://livehelperchat.com/3.44v-security-update-and-few-other-bits-586a.html
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63

Get alerted when CVE-2020-26135 or the next vulnerability affects your stack