CVE-2023-4253: Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the AI ChatBot WordPress plugin?
The vulnerability ID of the AI ChatBot WordPress plugin is CVE-2023-4253.
What is the severity of CVE-2023-4253?
The severity of CVE-2023-4253 is medium with a severity value of 4.8.
What is the affected software for CVE-2023-4253?
The affected software for CVE-2023-4253 is the AI ChatBot WordPress plugin before version 4.7.8.
What is the CWE category for CVE-2023-4253?
The CWE category for CVE-2023-4253 is CWE-79.
How can Stored Cross-Site Scripting (XSS) attacks be performed through CVE-2023-4253?
Stored Cross-Site Scripting (XSS) attacks can be performed through CVE-2023-4253 by high privilege users, such as admins, who can exploit the plugin's lack of sanitization and escaping in its settings.