CVE-2023-1011

CVE-2023-1011 affects the AI ChatBot WordPress plugin prior to 4.4.5. The issue is a stored XSS vector caused by insufficient escaping of settings output in the dashboard and a missing/weak CSRF protection, enabling a logged‑in admin to inject XSS payloads via the plugin settings. Evidence in con...

CVE-2023-1660

The CVE-2023-1660 entry concerns the AI ChatBot WordPress plugin prior to version 4.4.9, which lacks authorization checks and CSRF protection in a function hooked to init. This allows unauthenticated users to modify certain settings, and the lack of proper escaping when these settings are output ...