CVE-2023-1660 ChatBot < 4.4.9 - Unauthenticated Stored XSS

2023-05-0813:58:05

WPScan

www.cve.org

chatbot

wordpress

xss

unauthenticated

vulnerable

0.001 Low

EPSS

Percentile

47.2%

JSON

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "AI ChatBot",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.4.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/1a5cbcfc-fa55-433a-a76b-3881b6c4bea2

0.001 Low

EPSS

Percentile

47.2%

JSON

Related for CVELIST:CVE-2023-1660