This vulnerability (CVE-2024-35738) in Kognetiks Chatbot for WordPress is classified as CWE-79, indicating improper neutralization of input leading to stored cross-site scripting. It allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of users interacting with the chatbot. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability. The affected versions include all versions up to 1.9.8. No patch or official remediation has been disclosed yet.

Successful exploitation can lead to execution of arbitrary scripts in the context of users interacting with the chatbot, potentially compromising user data confidentiality, integrity, and availability of the affected WordPress site. The attack requires low privileges and user interaction but can have a persistent effect due to stored XSS nature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that interacts with the chatbot or applying web application firewall (WAF) rules to detect and block XSS payloads targeting the chatbot plugin. Monitor vendor channels for updates and patches.