Jotform 8211 Ai Chatbot
Monthly
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated cross-site scripting in the Jotform - AI Chatbot WordPress plugin (versions up to and including 3.8.2) allows remote attackers to have attacker-supplied script execute in a victim's browser session within the context of the affected site, since the plugin renders unsanitized input without adequate output encoding. Exploitation requires a victim to interact with attacker-controlled content (UI:R) - for example following a crafted link to, or loading, a page on which the vulnerable plugin output is displayed - while the attacker needs no authentication or privileges on the target (PR:N), making user interaction the primary limiting factor. Rated medium-to-high severity (reported CVSS 7.1, CWE-79, scope-changing client-side impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.