shouldiuse.io

Categories

VERDICT

CometChat Review

Depends

Should I use CometChat?

In-app Chat SDK & API for messaging and calling - cometchat.com

· 1 month ago

Buy if you're a dev team adding chat as a core feature of your app and can absorb per-MAU costs at scale. Skip if you want cheap plug-and-play chat or lack engineering resources to integrate and maintain SDKs.

Confidence

Medium. Based on 20+ public sources; many snippets truncated, so only confirmed figures are cited. No evidence names specific companies using competing services.

Ratings

  • Value for money
  • Ease of useNo clear third-party evidence
  • Feature depth
  • Support qualityReview base too thin to judge
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Basic and paid tiersPer-MAU, scales with usage
CometChat Air (self-hosted)Custom / enterprise

Best for

  • Apps where chat is the core product
  • Marketplaces, dating, and community apps
  • Dev teams wanting chat, calling, and moderation in one SDK
  • Regulated teams needing self-hosted chat (CometChat Air)

Not for

  • Solo founders needing a basic chat widget by Friday
  • Non-technical teams — this is an SDK, not plug-and-play
  • Anyone without budget headroom for per-MAU growth costs
  • Apps where chat is a nice-to-have, not the product

Gotchas - check before you buy

high

Patch the JS SDK and UI kits promptly — a stored-XSS CVE was disclosed in 2026

medium

Costs scale per monthly active user; budget for spikes as your app grows

medium

Vendor-written competitor pricing comparisons favor CometChat; verify independently

low

Trustpilot review base is tiny; validate support quality during a trial

Pros and cons

Pros

  • Full-stack SDKs: chat, voice, moderation, AI agents in one platform
  • Full-featured free plan to start
  • Named G2 High Performer
  • Self-hosted enterprise option (CometChat Air) for data control
  • Named customers include NoBroker, Multiply, Twogo, SDVerse

Cons

  • Stored-XSS CVE (CVE-2026-39154) in its JS SDK
  • React UI kit flagged with high-severity vulnerability
  • Per-MAU pricing gets expensive as you scale
  • Employee reviews average 2.2/5 — company-health warning sign

Sources & method

- 12 sources - Active vulnerability disclosure program and compliance efforts, but a 2026 stored-XSS CVE affected the JS SDK and a React UI kit was flagged high-severity.

official x4review x5security x2news x1
  • CVE-2026-39154 — Stored XSS in CometChat JS SDK, Disclosed 2026; affects the CometChat JavaScript SDK.
  • AIKIDO-2026-10360 — High vulnerability in @cometchat/chat-uikit-react, Affected versions flagged; users should upgrade the React UI kit.
  • Legacy: multiple vulnerabilities (2013), Historical exploit-db listing against the old PHP product; unlikely to affect current SDKs.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 3/5. Free tier exists; per-MAU costs scrutinized at scale
  • Ease of use. No clear third-party evidence
  • Feature depth: 4/5. Chat, calling, moderation, AI agents in one platform
  • Support quality. Review base too thin to judge
  • Security posture: 2/5. Recent stored-XSS CVE; otherwise strong compliance program
  • 50,000+ Customers self-reported, LinkedIn
  • 111 G2 reviews seller-profile reviews
  • $6.5M Latest funding 2026 strategic round, Run Ventures
  • Yes Free tier full-featured free plan

Pricing

Free

$0

  • Full-featured free plan
  • Entry-level usage

Basic and paid tiers

Per-MAU, scales with usage

  • Starting rates listed on site
  • Cost rises with monthly active users

CometChat Air (self-hosted)

Not disclosed

  • Self-hosted deployment
  • For data-control requirements

Security

Active vulnerability disclosure program and compliance efforts, but a 2026 stored-XSS CVE affected the JS SDK and a React UI kit was flagged high-severity.

  • CVE-2026-39154 — Stored XSS in CometChat JS SDKDisclosed 2026; affects the CometChat JavaScript SDK.⁹
  • AIKIDO-2026-10360 — High vulnerability in @cometchat/chat-uikit-reactAffected versions flagged; users should upgrade the React UI kit.10
  • Legacy: multiple vulnerabilities (2013)Historical exploit-db listing against the old PHP product; unlikely to affect current SDKs.

What users say

Third-party reviews are sparse: G2 names it a High Performer with mostly positive feedback, while at-scale pricing draws the loudest criticism.

“I love the new Cometchat!”
Trustpilot

Companies that use it

  • NoBroker12
  • Twogo
  • Multiply
  • SDVerse
Full analysis

Based on 20+ public sources; many snippets truncated, so only confirmed figures are cited. No evidence names specific companies using competing services.

Full-stack chat SDK where chat is core; per-MAU costs and a 2026 SDK CVE make it overkill for small MVPs.

Methodology

Based on 20+ public sources; many snippets truncated, so only confirmed figures are cited. No evidence names specific companies using competing services.

Read how a report is made.

Sources

  1. CometChat Pricingcometchat.com
    official
  2. CometChat: In-app Chat SDK & APIcometchat.com
    official
  3. CometChat Air — Self-hosted enterprise messagingcometchat.com
    official
  4. CometChat Reviews — G2g2.com
    review
  5. CometChat Reviews — Trustpilottrustpilot.com
    review
  6. How Much Does CometChat Cost? 2026 Plans & Real MAU Costhackceleration.com
    review
  7. CometChat Review 2026 — Findstackfindstack.com
    review
  8. CometChat employee reviews — AmbitionBoxambitionbox.com
    review
  9. CVE-2026-39154 — Stored XSS in CometChat JS SDKkitploit.com
    security
  10. AIKIDO-2026-10360 — chat-uikit-react vulnerabilityintel.aikido.dev
    security
  11. CometChat Secures $6.5M — PRNewswireprnewswire.com
    news
  12. NoBroker customer storycometchat.com
    official

Add this review to your site

This check for CometChat says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends CometChat Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.