This vulnerability (CVE-2026-28187) is an instance of CWE-79, improper neutralization of input during web page generation, resulting in Cross-Site Scripting (XSS). It affects unauthenticated users in the echoplugins Knowledge Base for Documentation, FAQs with AI Assistance product, specifically versions up to 17.211.0. The flaw allows attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the publication date.

Successful exploitation of this vulnerability could allow unauthenticated attackers to execute arbitrary scripts in users' browsers, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope change, with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying any available workarounds or input sanitization measures if possible. Monitor vendor communications for updates on official fixes. No vendor advisory or official remediation guidance is currently provided.