CVE-2023-1660

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-16615.4The Display post meta, term meta, comment meta, and user meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post metCVE-2023-16635.3Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The rooCVE-2023-16646.5A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverseCVE-2023-16659.8Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.CVE-2023-16669.8A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerabilitCVE-2023-16676.5A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cauCVE-2023-16688.2A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action mCVE-2023-16697.2The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such CVE-2023-16707.8A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crashCVE-2023-16719.8A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution CVE-2023-16725.3A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window whereCVE-2023-16749.8A vulnerability was found in SourceCodester School Registration and Fee System 1.0 and classified as critical. This issue affects some unkno