Filtered by vendor Collect.chat Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-6498 2 Collect.chat, Micro.company 2 Chatbot, Collect.chat 2024-09-06 4.8 Medium
The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2023-5691 1 Collect.chat 1 Chatbot 2024-08-02 4.4 Medium
The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.