CVE-2023-1651

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-16527.1A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could all CVE-2023-16547.8Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-16557.8Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.CVE-2023-16567.5Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connecto CVE-2023-16606.1The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated use CVE-2023-16615.4The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post met CVE-2023-16635.3Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The roo CVE-2023-16646.5A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse CVE-2023-16659.8Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.CVE-2023-16669.8A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerabilit CVE-2023-16676.5A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cau CVE-2023-16688.2A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action m