CVE-2023-1651

🗓️ 08 May 2023 13:58:09Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

The AI ChatBot WordPress plugin before 4.4.9 lacks authorization and has a CSRF vulnerability in the AJAX action, allowing unauthorized users to update OpenAI settings, potentially leading to Stored XSS

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-1651	8 May 202318:37	–	circl
CNNVD	WordPress plugin AI ChatBot 跨站脚本漏洞	8 May 202300:00	–	cnnvd
Cvelist	CVE-2023-1651 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS	8 May 202313:58	–	cvelist
EUVD	EUVD-2023-23880	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1651	8 May 202314:15	–	nvd
OSV	CVE-2023-1651	8 May 202314:15	–	osv
Patchstack	WordPress ChatBot Plugin <= 4.4.8 is vulnerable to Cross Site Scripting (XSS)	20 Apr 202300:00	–	patchstack
Prion	Cross site scripting	8 May 202314:15	–	prion
RedhatCVE	CVE-2023-1651	23 May 202502:32	–	redhatcve
Vulnrichment	CVE-2023-1651 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS	8 May 202313:58	–	vulnrichment

NVD

Vulners

Node

quantumcloud wpbotRange<4.4.9wordpress

[
  {
    "vendor": "Unknown",
    "product": "AI ChatBot",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.4.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c88b22ba-4fc2-49ad-a457-224157521bad

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	AJAX action openai_settings_option allows unauthorised updates to OpenAI settings via crafted request, enabling stored XSS due to unescaped settings.	CWE-352, CWE-79, CWE-306
api_key	request body	wp-admin/admin-ajax.php	AJAX action openai_settings_option allows unauthorised updates to OpenAI settings via crafted request, enabling stored XSS due to unescaped settings.	CWE-352, CWE-79, CWE-306
page	path	wp-admin/admin.php?page=wpbot_openAi	Admin settings page for OpenAI configuration is vulnerable to stored XSS when viewing the OpenAI Settings page by a subscriber.	CWE-79, CWE-352, CWE-306

17 Jun 2026 05:28Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

EPSS0.00242

SSVC