CVE-2023-1651

ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

Medium · published May 8, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Published
2023-05-08T13:58Z
EPSS history
Timeline
  • 08 MAY 13:58Z
    ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS
    cvelistv5