Description

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:17:00.717Z",
  "pubdate": "2026-08-13T14:17:00.717Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Knowledge Base for Documentation, FAQs with AI Assistance product affecting versions 17.211.0 and below. This security flaw allows remote, unauthenticated threat actors to inject malicious client-side scripts, typically JavaScript, into vulnerable web pages viewed by other users. The primary impact of this vulnerability includes session hijacking, credential theft, arbitrary redirection, and the manipulation of DOM content within the context of the victim's browser session. Because the vulnerability requires no authentication or prior access privileges, it significantly lowers the barrier for exploitation by external malicious entities. Risk implications involve compromised user accounts, potential data exfiltration, and unauthorized actions performed on behalf of authenticated administrators or regular users interacting with the documentation or FAQ pages. Exploitation requirements are minimal, typically involving tricking a user into navigating to a crafted URL containing the malicious payload or leveraging improperly sanitized input parameters handled by the application.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient output encoding within the Knowledge Base for Documentation, FAQs with AI Assistance plugin for versions <= 17.211.0. Specifically, the application fails to properly sanitize user-supplied data before reflecting it back into the Document Object Model (DOM) of the web page, resulting in a reflected or stored Cross-Site Scripting condition.\nRoot Cause: The underlying root cause is the lack of context-aware output encoding and strict input sanitization routines on parameters processed by the vulnerable component. When the application dynamically generates HTML content containing user-controlled input, it executes raw data strings directly within the browser context.\nAuthentication Requirements: Zero authentication is required to deliver the payload, exposing the attack surface to unauthenticated network traffic. Privilege Requirements: No elevated privileges are needed to initiate the attack vector. Network Exposure: The vulnerable endpoints are exposed over standard web protocols (HTTP/HTTPS) and are accessible to any external network adversary.\nAttack Flow: 1. The attacker crafts a malicious URI containing an HTML or JavaScript payload designed to trigger execution within a victim's browser. 2. The unauthenticated attacker transmits the payload to the vulnerable Knowledge Base for Documentation, FAQs with AI Assistance component via HTTP GET or POST parameters. 3. The vulnerable component processes the input without adequate sanitization and embeds the malicious payload into the HTTP response. 4. The victim's browser receives the response and parses the injected script as legitimate executable code. 5. The payload executes within the security context of the victim's session, enabling actions such as accessing document.cookie, stealing session tokens, performing unauthorized API requests, or defacing the interface.\nPost-Exploitation Impact: Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to administrative account compromise if an authenticated privileged user falls victim to the exploit."
}