PT-2023-32209 · WordPress · Chatbot

Huynh Tien Si · Published 2023-11-02 · Updated 2023-11-09 · CVE-2023-5606

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The ChatBot for WordPress versions 4.8.6 through 4.9.6

Description The issue arises from insufficient input sanitization and output escaping in the FAQ Builder, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. This affects multi-site installations and installations where unfiltered html has been disabled, enabling the execution of injected scripts when a user accesses the affected page.

Recommendations For versions 4.8.6 through 4.9.6, update to a version that addresses the insufficient input sanitization and output escaping in the FAQ Builder to prevent stored cross-site scripting attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-5606

Affected Products

Chatbot

References · 6

• https://osv.dev/vulnerability/CVE-2023-5606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5606 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail= · Patch
• https://t.me/cibsecurity/73414 · Telegram Post
• https://t.me/cvenotify/60357 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cve · Note