CVE-2023-4254

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425405.5Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via imp CVE-2023-425415.3Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.CVE-2023-425423.3Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the devi CVE-2023-425437.5Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arb CVE-2023-425445.5Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files.CVE-2023-425457.5Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in An CVE-2023-425466.5Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.CVE-2023-425476.5Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00 CVE-2023-425486.5Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.CVE-2023-425496.5Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.CVE-2023-42555.5An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. CVE-2023-425506.5Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attacke