Medium severity · published Oct 27, 2025
CVE-2025-12245
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was identified in chatwoot up to 4.7.0. This vulnerability affects the function initPostMessageCommunication of the file app/javascript/sdk/IFrameHelper.js of the component Widget. The manipulation of the argument baseUrl leads to origin validation error. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
chatwoot ·
4.0; 4.1; 4.2; 4.3; 4.4; 4.5; +2 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12245
Exploit
https://hckwr.com/blog/multiple-vulnerabilities-in-chatwoot/
Permissions Required
https://vuldb.com/?ctiid.329916
Third Party Advisory
https://vuldb.com/?id.329916
Third Party Advisory
https://vuldb.com/?submit.673800
More from chatwoot
7.3
CVE-2026-4990
chatwoot Signup Endpoint login improper authorization
6.3
CVE-2026-5205
chatwoot Webhook API trigger.rb Trigger server-side request forgery
6.1
CVE-2025-12246
chatwoot Admin IframeLoader.vue cross site scripting