CVE-2023-1660

ChatBot < 4.4.9 - Unauthenticated Stored XSS

Medium · published May 8, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Published
2023-05-08T13:58Z
EPSS history
Timeline
  • 08 MAY 13:58Z
    ChatBot < 4.4.9 - Unauthenticated Stored XSS
    cvelistv5