CVE-2024-38757

The Typebot plugin for WordPress versions prior to 3.6.0 contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation. This allows an authenticated attacker to inject arbitrary JavaScript into the plugin's data, which is later served to other users.

Exploitation requires an attacker with sufficient privileges (such as a contributor or author) to input malicious code into fields that are not properly sanitized. When an administrator or other user accesses the affected page, the injected script executes in their browser. The Patchstack advisory notes that user interaction may be required depending on the specific attack vector. [1]

Successful exploitation could allow an attacker to perform actions such as redirecting visitors to malicious sites, displaying advertisements, or stealing session cookies. This could compromise the integrity of the website and affect visitors.

The vulnerability has been addressed in Typebot version 3.6.1. Users are strongly advised to update immediately. Patchstack also provides a mitigation rule for those using their security service. [1]