← Back to the live CVE advisory feed

CVE-2026-14933: Cross-site scripting in the embedded co-browsing feature in Unblu inc

Severity

8.6 (HIGH)

Affected versions

Through 7.57.7

Patch status

Unknown

Published

2026-10-20T12:17:30.057

Modified

2026-10-20T19:28:52.970

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.

View the official NVD record for CVE-2026-14933

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.