CVE-2023-5241

CVE-2023-5241 affects the WordPress AI ChatBot plugin. It is a Directory Traversal via the function qcld_openai_upload_pagetraining_file , enabling subscriber‑level attackers to append PHP code to existing server files (e.g., wp-config.php), with potential DoS. Affected versions are up to 4.8.9 a...

CVE-2023-1650

The CVE-2023-1650 entry concerns the AI ChatBot WordPress plugin (before 4.4.7). The vulnerability arises from unserializing user input stored in cookies via an AJAX action accessible to unauthenticated users, enabling PHP Object Injection if a compatible gadget is present. Affected software: Wor...

CVE-2023-5204

CVE-2023-5204 affects the WordPress AI ChatBot plugin by QuantumCloud. The vulnerability is an unauthenticated SQL Injection via the POST parameter strid used by the ajax handler qc_wpbo_search_response. The underlying issue is insufficient escaping and lack of prepared statements for the SQL que...

CVE-2023-5533

CVE-2023-5533 affects the WordPress AI ChatBot plugin. The vulnerability arises from missing capability checks on multiple AJAX actions, allowing unauthenticated users to invoke actions intended for higher-privileged users. Affected versions are up to and including 4.8.9 and also 4.9.2. Wordfence...

CVE-2023-5212

CVE-2023-5212 refers to the AI ChatBot for WordPress, where an authenticated subscriber+ can misuse the qcld_openai_delete_training_file path to perform an arbitrary file deletion on the server. Affected versions are

CVE-2024-22309

CVE-2024-22309 : WordPress ChatBot with AI plugin vulnerable up to 5.1.0 due to deserialization of untrusted data (PHP Object Injection). Exploitation requires no authentication. Connected sources indicate the issue was fixed with patches in newer releases; ensure upgrade to a non-vulnerable vers...