CVE-2023-1011: ChatBot < 4.4.5 - Stored XSS via CSRF
Published May 8, 2023
·Updated
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.
Affected Software
2 affected components
QuantumCloud Ai Chatbot Wordpress<4.4.5
QuantumCloud Wpbot Wordpress<4.4.5
Event History
May 8, 2023
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
DescriptionWeakness
Data Sourced
02:15 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for the AI ChatBot WordPress plugin?
The vulnerability ID for the AI ChatBot WordPress plugin is CVE-2023-1011.
2
What is the severity rating of CVE-2023-1011?
CVE-2023-1011 has a severity rating of medium (6.1).
3
What does the AI ChatBot WordPress plugin vulnerability allow attackers to do?
The vulnerability allows attackers to make a logged-in admin set XSS payloads in the plugin's settings.
4
Is there a fix available for CVE-2023-1011?
Yes, the fix for CVE-2023-1011 is to update the AI ChatBot WordPress plugin to version 4.4.5 or newer.
5
Where can I find more information about CVE-2023-1011?
More information about CVE-2023-1011 can be found at: https://wpscan.com/vulnerability/d1784446-b3da-4175-9dac-20b030f19984