Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Webdigit Clear all filters
TI-2024-06347 CVE-2024-6845 · GHSA-2q3v-8m45-45jg

SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure

Priority MEDIUM 63

The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the Op…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01104 Published 2024-09-25 Fixed in 2.4.6 CWE-862
TI-2024-06348 CVE-2024-6846 · GHSA-x54p-439w-h3mq

SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

Priority MEDIUM 63

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01252 Published 2024-09-05 Fixed in 2.4.5
TI-2024-06349 CVE-2024-6847 · GHSA-725x-5972-gm8m

SmartSearch WP <= 2.4.4 - Unauthenticated SQLi

Priority HIGH 82

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00739 Published 2024-08-20 Fixed in 2.4.5 CWE-89
TI-2024-06345 CVE-2024-6843 · GHSA-r3cc-j4fw-h337

SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS

Priority MEDIUM 60

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00409 Published 2024-08-19 Fixed in 2.4.5 CWE-79