Quantumcloud

Wpbot

32 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2023-44993

  • EPSS 0.21%
  • Veröffentlicht 09.10.2023 11:15:10
  • Zuletzt bearbeitet 12.05.2025 15:09:58

Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions.

4.8

CVE-2023-4254

Exploit
  • EPSS 0.48%
  • Veröffentlicht 04.09.2023 12:15:10
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed...

4.8

CVE-2023-4253

Exploit
  • EPSS 0.49%
  • Veröffentlicht 04.09.2023 12:15:10
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed...

4.8

CVE-2023-3175

Exploit
  • EPSS 0.61%
  • Veröffentlicht 10.07.2023 16:15:55
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

4.8

CVE-2023-2811

Exploit
  • EPSS 0.44%
  • Veröffentlicht 19.06.2023 11:15:10
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client w...

4.8

CVE-2023-2742

Exploit
  • EPSS 0.47%
  • Veröffentlicht 19.06.2023 11:15:10
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

6.1

CVE-2023-1660

Exploit
  • EPSS 0.27%
  • Veröffentlicht 08.05.2023 14:15:13
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admi...

5.4

CVE-2023-1651

Exploit
  • EPSS 0.24%
  • Veröffentlicht 08.05.2023 14:15:12
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escap...

9.8

CVE-2023-1650

Exploit
  • EPSS 34.35%
  • Veröffentlicht 08.05.2023 14:15:12
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog

4.8

CVE-2023-1649

Exploit
  • EPSS 0.44%
  • Veröffentlicht 08.05.2023 14:15:12
  • Zuletzt bearbeitet 12.05.2025 15:09:58

The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disall...