CVE-2023-5534

Summary: CVE-2023-5534 concerns the AI ChatBot WordPress plugin with CSRF due to missing/incorrect nonce validation in certain functions, affecting versions ≤ 4.8.9 and 4.9.2. Unauthenticated attackers can exploit forged requests to trigger actions when a site admin is enticed to click links. Imp...

CVE-2024-0451

CVE-2024-0451 affects the WordPress AI ChatBot for WordPress (WPBot) plugin. The vulnerability is due to a missing capability check in openai_file_list_callback across versions up to and including 5.3.4, enabling authenticated users with subscriber-level access and above to enumerate files in a l...

CVE-2024-6669

The CVE CVE-2024-6669 affects the WPBot WordPress plugin (AI ChatBot for WordPress) up to version 5.5.7, enabling Stored Cross-Site Scripting via admin settings and requiring administrator+ privileges. Impact is limited to multisite setups or where unfiltered_html is disabled; a fix exists in ver...

CVE-2023-5254

CVE-2023-5254 affects the AI ChatBot WordPress plugin. The vulnerability is an unauthenticated Sensitive Information Exposure via the qcld_wb_chatbot_check_user function, impacting versions up to and including 4.8.9. An attacker can confirm whether a username exists and view order information for...

CVE-2022-47613

CVE-2022-47613 affects the WordPress AI ChatBot/ChatBot plugin up to version 4.3.0. The vulnerability is a stored XSS that requires admin+ privileges to exploit. Multiple connected sources (Patchstack and WP vuln entries) indicate the issue arises from insufficient input sanitization in the chatb...

CVE-2023-1651

The CVE-2023-1651 entry concerns the WordPress plugin AI ChatBot prior to version 4.4.9. The vulnerability arises from missing authorization and CSRF protection in the AJAX action used to update OpenAI settings, allowing any authenticated user (e.g., subscribers) to modify settings. Additionally,...