The vulnerability CVE-2025-22813 affects QuantumCloud Conversational Forms for ChatBot (versions up to 1.4.2) and is classified as a stored cross-site scripting (XSS) flaw. It results from improper neutralization of input during the generation of web pages, enabling attackers to inject and store malicious scripts that execute when users access the affected chatbot forms. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available, and no exploits have been reported in the wild.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the chatbot forms, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS score of 6.5 indicates a medium severity risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when deploying affected versions of QuantumCloud Conversational Forms for ChatBot and consider implementing input validation or output encoding as temporary mitigations where possible.