Tools AI Risk Radar ai-incident-0196
Incident record
Jotform AI Chatbot plugin exposes a script-injection flaw
- Severity
- High
- Status
- Research
- Type
- Infra Vuln
- Target
- Jotform AI Chatbot through 3.8.2
- Actor
- researcher
- CVE
- CVE-2026-40803
What happened
An unauthenticated attacker can inject malicious scripts through the WordPress chatbot plugin. The reported impact includes stealing visitor data or hijacking accounts.
Patchstack published the disclosure on 6 October; the CVE followed on 10 October. The CNA gives CVSS 3.1 score 7.1. Patchstack offers a mitigation rule while awaiting an official patch. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-40803
- Patchstack disclosurepatchstack.com/database/wordpress/plugin/jotform-ai-chatbot/…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026