Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-1651

ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown AI ChatBot

Default version status: unaffected

  • 0 to < 4.4.9affected

References