Threat Entry Updated 2025-05-12

CVE-2023-1011 - Wpbot Plugin

The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.

PLUGIN Wpbot

CVE-2023-1011

MEDIUM CVSS 6.1 2023-05-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-12

CVE-2023-1651 - Wpbot Plugin

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

PLUGIN Wpbot

CVE-2023-1651

MEDIUM CVSS 5.4 2023-05-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-12

CVE-2023-1649 - Wpbot Plugin

The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

PLUGIN Wpbot

CVE-2023-1649

MEDIUM CVSS 4.8 2023-05-08

Risk Score

Open Full Technical Breakdown