CVE-2023-1011

ChatBot < 4.4.5 - Stored XSS via CSRF

Medium · published May 8, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Published
2023-05-08T13:58Z
EPSS history
Timeline
  • 08 MAY 13:58Z
    ChatBot < 4.4.5 - Stored XSS via CSRF
    cvelistv5