QuantumCloud WPBot any version

ChatBot < 4.4.7 - Unauthenticated PHP Object Injection

AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF)

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback

WordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection

ChatBot < 4.4.9 - Unauthenticated Stored XSS

ChatBot < 4.4.5 - Stored XSS via CSRF

WordPress AI ChatBot Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)

AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions

AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback

AI ChatBot < 4.6.1 - Admin+ Stored Cross-Site Scripting

Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder

Chatbot < 4.7.8 - Admin+ Stored XSS in Language Settings

AI ChatBot < 4.5.5 - Admin+ Stored Cross-Site Scripting

AI ChatBot < 4.5.6 - Admin+ Stored Cross-Site Scripting

ChatBot < 4.5.1 - Admin+ Stored XSS

The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.

AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS

WPBOT < 7.1.0 - Admin+ Stored XSS