CVE-2023-1651 ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

What is CVE-2023-1651?

CVE-2023-1651 is a medium-severity cross-site scripting vulnerability in Unknown AI ChatBot, published on 8 May 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

Which versions are affected by CVE-2023-1651?

It affects 1 product.

Products include Quantumcloud Wpbot.

How do I fix CVE-2023-1651?

No fix has been published for CVE-2023-1651 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-1651 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1651 exists.

Other vulnerabilities in Unknown AI ChatBot

• CVE-2023-5204 AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response Critical 9.8
• CVE-2023-1650 ChatBot < 4.4.7 - Unauthenticated PHP Object Injection Critical 9.8
• CVE-2023-5212 Path traversal in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Critical 9.6
• CVE-2023-5241 Path traversal in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Critical 9.6
• CVE-2024-22309 WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3fx8-h7hv-rjf7.