What is CVE-2026-30048?

CVE-2026-30048 is a medium-severity vulnerability in N/a, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-18.

How severe is CVE-2026-30048?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2026-30048 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in N/a

CVE-2026-30048

A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when the chat history is reloaded. The issue is reproducible across multiple independent implementations of the widget, indicating that the vulnerability resides in the product itself rather than in a specific website configuration.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (16.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

0xN4no/CVE-2026-30048

References

Frequently asked questions

What is CVE-2026-30048?: CVE-2026-30048 is a medium-severity vulnerability in N/a, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-18.
How severe is CVE-2026-30048?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2026-30048 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.