Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
1 selected

2 records

Release: AI ChatBot 4.4.9 Clear all filters
TI-2023-01553 CVE-2023-1651 · GHSA-3fx8-h7hv-rjf7

ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

Priority MEDIUM 58

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00242 Published 2023-05-08 Fixed in 4.4.9
TI-2023-01558 CVE-2023-1660 · GHSA-c22m-r7gh-963v

ChatBot < 4.4.9 - Unauthenticated Stored XSS

Priority MEDIUM 60

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping wh…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2023-05-08 Fixed in 4.4.9