CVE-2023-1660: ChatBot < 4.4.9 - Unauthenticated Stored XSS
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the AI ChatBot WordPress plugin?
The vulnerability ID of the AI ChatBot WordPress plugin is CVE-2023-1660.
What is the severity of CVE-2023-1660?
CVE-2023-1660 has a severity rating of medium (6.1).
What does CVE-2023-1660 allow unauthenticated users to do?
CVE-2023-1660 allows unauthenticated users to update certain settings, leading to Stored XSS (Cross-Site Scripting) in the admin dashboard.
How can the AI ChatBot WordPress plugin vulnerability be fixed?
To fix the AI ChatBot WordPress plugin vulnerability (CVE-2023-1660), update to version 4.4.9 or later.
What are the Common Weakness Enumeration (CWE) categories associated with CVE-2023-1660?
The Common Weakness Enumeration (CWE) categories associated with CVE-2023-1660 are CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-352 (Cross-Site Request Forgery (CSRF)).