The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-11-02T08:31:43.007Z
Updated: 2024-08-02T08:07:32.240Z
Reserved: 2023-10-16T21:35:09.687Z
Link: CVE-2023-5606
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-11-02T09:15:08.507
Modified: 2024-11-21T08:42:06.727
Link: CVE-2023-5606
Redhat
No data.