CVE-2026-40803: WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The issue is unauthenticated, so an attacker does not need an account or other privileges. Exploitation requires user interaction.

Q: What is the potential impact if exploitation succeeds?

The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. This is an XSS vulnerability, so impact occurs through script execution in a user's browser context.

Q: Which plugin versions are affected?

Jotform AI Chatbot versions 3.8.2 and earlier are identified as affected.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.

Affected Software

1 affected component

Jotform Jotform AI Chatbot<=3.8.2

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is unauthenticated, so an attacker does not need an account or other privileges. Exploitation requires user interaction.

What is the potential impact if exploitation succeeds?

The supplied CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. This is an XSS vulnerability, so impact occurs through script execution in a user's browser context.

Which plugin versions are affected?

Jotform AI Chatbot versions 3.8.2 and earlier are identified as affected.

CVE-2026-40803: WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?