ChatBot < 4.4.9 - Unauthenticated Stored XSS

Vulnerability

The AI ChatBot WordPress plugin versions before 4.4.9 lack authorization and CSRF protection in a function hooked to the init action. This allows unauthenticated users to update certain plugin settings. Because the plugin does not escape these settings when outputting them in the admin dashboard, a stored cross-site scripting (XSS) vulnerability exists [1].

Exploitation

An unauthenticated attacker can craft a request to update plugin settings without a CSRF token. By injecting malicious JavaScript into a setting that is later displayed in the admin dashboard, the attacker can achieve stored XSS. No authentication or user interaction is required for the initial injection [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to session hijacking, defacement of the admin interface, or further compromise of the WordPress site [1].

Mitigation

The vulnerability is fixed in version 4.4.9 of the AI ChatBot plugin. Users should update to this version or later. No workarounds are documented in the available references [1].