The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into pages served by the Jotform – AI Chatbot plugin. Because authentication is not required, any visitor to a site running a vulnerable version could execute the payload in the victim’s browser context. This could enable session hijacking, cookie theft, defacement, or the delivery of additional malware to the user. The weakness is a classic input validation error (CWE‑79).

The Jotform – AI Chatbot WordPress plugin, versions 3.8.2 and earlier, is affected. Site administrators running these or older plugin versions are at risk.

The CVSS base score of 7.1 reflects a moderate‑to‑high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog at this time. The flaw can be exploited by any web user who can view a page rendered by the plugin, making the attack vector broadly accessible. No prerequisites beyond exposure to the plugin are needed, and the exploitation path is straightforward.