CVE-2023-1651

🗓️ 08 May 2023 13:58:09Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

The AI ChatBot WordPress plugin before 4.4.9 lacks authorization and has a CSRF vulnerability in the AJAX action, allowing unauthorized users to update OpenAI settings, potentially leading to Stored XSS

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2023-1651	8 May 202318:37	–	circl
CNNVD	WordPress plugin AI ChatBot 跨站脚本漏洞	8 May 202300:00	–	cnnvd
Cvelist	CVE-2023-1651 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS	8 May 202313:58	–	cvelist
EUVD	EUVD-2023-23880	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1651	8 May 202314:15	–	nvd
OSV	CVE-2023-1651	8 May 202314:15	–	osv
Patchstack	WordPress ChatBot Plugin <= 4.4.8 is vulnerable to Cross Site Scripting (XSS)	20 Apr 202300:00	–	patchstack
Prion	Cross site scripting	8 May 202314:15	–	prion
RedhatCVE	CVE-2023-1651	23 May 202502:32	–	redhatcve
Vulnrichment	CVE-2023-1651 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS	8 May 202313:58	–	vulnrichment

NVD

Vulners

Node

quantumcloud wpbotRange<4.4.9wordpress

[
  {
    "vendor": "Unknown",
    "product": "AI ChatBot",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.4.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c88b22ba-4fc2-49ad-a457-224157521bad

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	AJAX action openai_settings_option vulnerable to unauthorized modification and stored XSS due to lack of authentication/CSRF and escaping in settings	CWE-79
api_key	request body	/wp-admin/admin-ajax.php	AJAX action openai_settings_option vulnerable to unauthorized modification and stored XSS due to lack of authentication/CSRF and escaping in settings	CWE-79
page=wpbot_openAi	path	/wp-admin/admin.php?page=wpbot_openAi	Admin page loading OpenAI settings can trigger stored XSS if crafted payload is persisted by insecure settings handling	CWE-79

12 May 2025 15:09Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

EPSS0.00108

SSVC