AI ChatBot for eCommerce – WoowBot <= 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Description
The AI ChatBot for eCommerce – WoowBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=4.6.1What Changed in the Fix
Changes introduced in v4.7.0
Source Code
WordPress.org SVN<script>alert(1)</script>`. If the plugin has a "Help" or "Support" message that is echoed on the frontend *without* escaping. Let's check the `functions.php` for any other `get_option`. I see `qlcd_woo_chatbot_conversations_with` and `qlcd_woo_chatbot_agent`. If the vulnerability i…
Show full research plan
If the plugin has a "Help" or "Support" message that is echoed on the frontend *without* escaping.
Let's check the `functions.php` for any other `get_option`.
I see `qlcd_woo_chatbot_conversations_with` and `qlcd_woo_chatbot_agent`.
If the vulnerability is that a Subscriber can call `wp_ajax_qcld_woo_chatbot_save_settings` (inferred) and update these.
Wait, I see a potential mismatch in the provided `functions.php`.
```php
<h3> <?php if(get_option('qlcd_woo_chatbot_agent')!=''){echo esc_attr( get_option('qlcd_woo_chatbot_agent') );} ?></h3>
```
If I change `qlcd_woo_chatbot_agent` to `</script><script>alert(1)</script>`, `esc_attr` handles it.
*But*, what if I change `woo_chatbot_custom_css`?
If I change it to `body{} </style><script>alert(1)</script><style>`.
`esc_attr` converts `<` to `<`.
The resulting HTML: `<style>body{} </style><script>alert(1)</script><style></style>`.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.