CVE-2026-40803: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jotform Jotform – AI Chatbot

This vulnerability (CVE-2026-40803) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to Cross-Site Scripting (XSS). It affects Jotform – AI Chatbot versions up to 3.8.2. The flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of users interacting with the chatbot, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with low confidentiality, integrity, and availability impacts.

Successful exploitation can lead to execution of arbitrary scripts in the context of users interacting with the affected chatbot, potentially allowing theft of user data, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a low level. The vulnerability does not require authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, users should exercise caution when interacting with the affected versions and consider mitigating controls such as input validation or web application firewalls if feasible.