XSS in Nice Chat
CVE-2025-59902
HTML injection vulnerability in NICE Chat. This vulnerability allows an attacker to inject and render arbitrary HTML content in email transcripts by modifying the 'firstName' and 'lastName' parameters during a chat session. The injected HTML is included in the body of the email sent by the system, which could enable phishing attacks, impersonation, or credential theft.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (26.7th percentile) — read the EPSS interpretation.
Affected products
- Nice Chat — versions all versions