CVE-2023-1660

ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.5

CVSS Score

6.5

CVSS Score

medium

Severity

4.4.9

Patched in

286d

Time to patch

Description

The ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in the Admin Dashboard in versions up to, and including, 4.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers (leveraging a function hooked to init that lacks authorization and CSRF checks) to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=4.4.8

PublishedApril 12, 2023

Last updatedJanuary 22, 2024

Affected pluginchatbot

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/c4feb8e8-8620-44b9-9e8d-7ea513e168ff?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database