Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

449new WordPress flaws this week

390,525entries in the database

412 results · page 6 of 9

Dec 2, 2024ImbaChat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52502 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImbaSynergy ImbaChat imbachat-widget allows DOM-Based XSS.This issue affects ImbaChat: from n/a through <= 3.1.4.
Product
ImbaChat
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update ImbaChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 2, 2024Add Chat App Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52489 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through <= 2.1.5.
Product
Add Chat App Button
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Add Chat App Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024WeChat Subscribers Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through <= 1.6.6.
Product
WeChat Subscribers Lite
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update WeChat Subscribers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Elfsight Telegram Chat CC: Unauthorized modification of data to a missing capability check on the 'updatePreferences' functionCVE-2024-10390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Elfsight Telegram Chat CC
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Elfsight Telegram Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 15, 2024WP Chat App: Unauthorized plugin installationCVE-2024-10533 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the filebird plugin.
Product
WP Chat App
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update WP Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 14, 2024Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation: Unrestricted Upload of File with Dangerous TypeCVE-2024-52384 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation ai-content-generator allows Upload a Web Shell to a Web Server.This issue affects Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation: from n/a through <= 2.4.9.
Product
Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 14, 2024Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Missing AuthorizationCVE-2024-52383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.1.2.
Product
Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 12, 2024Kognetiks Chatbot for: Cross-Site Request ForgeryCVE-2024-11143 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.8. This is due to missing or incorrect nonce validation on the update_assistant, add_new_assistant, and delete_assistant functions. This makes it possible for unauthenticated attackers to modify assistants via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Kognetiks Chatbot for
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024Kognetiks Chatbot for: Reflected Cross-Site ScriptingCVE-2024-10684 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10531 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to update GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10530 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the add_new_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create new GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2024Kognetiks Chatbot for: Unauthorized modification of dataCVE-2024-10529 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete GTP assistants.
Product
Kognetiks Chatbot for
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 1, 2024Group Chat & Video Chat by AtomChat: Stored Cross-Site ScriptingCVE-2024-10232 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Group Chat & Video Chat by AtomChat
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Group Chat & Video Chat by AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 29, 2024Monitor.chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49639 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Stoever Monitor.chat monitor-chat allows Reflected XSS.This issue affects Monitor.chat: from n/a through <= 1.1.1.
Product
Monitor.chat
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Monitor.chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2024chatplusjp: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chatplusjp chatplusjp chatplusjp allows Reflected XSS.This issue affects chatplusjp: from n/a through <= 1.02.
Product
chatplusjp
Affected
up to 1.02
What to do
Affects up to 1.02. Update chatplusjp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 25, 2024WPS Telegram Chat: Authorization bypassCVE-2024-9630 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.
Product
WPS Telegram Chat
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WPS Telegram Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024WPS Telegram Chat: Unauthorized modification of data and loss of dataCVE-2024-9628 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.
Product
WPS Telegram Chat
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WPS Telegram Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2024AVChat Video Chat: Cross-Site Request Forgery (CSRF)CVE-2024-49605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.
Product
AVChat Video Chat
Affected
up to 2.2
What to do
Affects up to 2.2. Update AVChat Video Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 18, 2024Click to Chat – WP Support All-in-One Floating Widget: Stored Cross-Site ScriptingCVE-2024-10055 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-49281 may be a duplicate of this issue.
Product
Click to Chat – WP Support All-in-One Floating Widget
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 17, 2024Click to Chat – WP Support All-in-One Floating Widget: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-49281 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through <= 2.3.3.
Product
Click to Chat – WP Support All-in-One Floating Widget
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Click to Chat – WP Support All-in-One Floating Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 16, 2024Facebook Chat: Authorization bypassCVE-2020-36838 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
Product
Facebook Chat
Affected
up to 1.5
What to do
Affects up to 1.5. Update Facebook Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 5, 2024Instant Chat Floating Button for WordPress Websites: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44018 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
Product
Instant Chat Floating Button for WordPress Websites
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Instant Chat Floating Button for WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 1, 2024Wechat Social login: Arbitrary file uploadsCVE-2024-9108 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convert_remoteimage_to_local' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Wechat Social login
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024Wechat Social login: Authentication bypassCVE-2024-9106 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. This is only exploitable if the app secret is not set, so it has a default empty value.
Product
Wechat Social login
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Wechat Social login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 1, 2024RumbleTalk Live Group Chat – HTML5: Stored Cross-Site ScriptingCVE-2024-8720 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RumbleTalk Live Group Chat – HTML5
Affected
up to 6.3.0
What to do
Affects up to 6.3.0. Update RumbleTalk Live Group Chat – HTML5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2024123.chat - Video Chat: Stored Cross-Site ScriptingCVE-2024-7869 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The 123.chat - Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
123.chat - Video Chat
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update 123.chat - Video Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2CVE-2024-7714 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback'
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 27, 2024AI ChatBot with ChatGPT and Content Generator by AYS: Discloses the Open AI API KeyCVE-2024-7713 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Fixed in
2.1.0
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 25, 2024Chatbot with ChatGPT: Does not have proper authorization in one of its REST endpointCVE-2024-6845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
Product
Chatbot with ChatGPT
Fixed in
2.4.6
What to do
Update Chatbot with ChatGPT to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com
Sep 12, 2024Gixaw Chat: Does not have CSRF check in some placesCVE-2024-7816 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Gixaw Chat
Affected
up to 1.0
What to do
Affects up to 1.0. Update Gixaw Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 5, 2024Chatbot with ChatGPT: Does not validate access on some REST routesCVE-2024-6846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
Product
Chatbot with ChatGPT
Fixed in
2.4.5
What to do
Update Chatbot with ChatGPT to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2024Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot: Does not sanitise and escape some of its settingsCVE-2024-6722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 30, 2024HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics: Stored Cross-Site ScriptingCVE-2024-5879 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
Affected
up to 11.1.22
What to do
Affects up to 11.1.22. Update HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2024Chatbot with ChatGPT: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6847 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
Product
Chatbot with ChatGPT
Fixed in
2.4.5
What to do
Update Chatbot with ChatGPT to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2024Chatbot with ChatGPT: Does not sanitise and escape user inputsCVE-2024-6843 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Product
Chatbot with ChatGPT
Fixed in
2.4.5
What to do
Update Chatbot with ChatGPT to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2024Chatbot for WordPress by Collect.chat ⚡️: Does not sanitise and escape some of its settingsCVE-2024-6498 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Chatbot for WordPress by Collect.chat ⚡️
Fixed in
2.4.4
What to do
Update Chatbot for WordPress by Collect.chat ⚡️ to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-38791 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
Product
AI Engine: ChatGPT Chatbot
Affected
up to 2.4.7
What to do
Affects up to 2.4.7. Update AI Engine: ChatGPT Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 20, 2024TOCHAT.BE: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37563 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TOCHAT.BE allows Stored XSS.This issue affects TOCHAT.BE: from n/a through 1.3.0.
Product
TOCHAT.BE
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update TOCHAT.BE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 17, 2024AI ChatBot for WordPress – WPBot: Stored Cross-Site ScriptingCVE-2024-6669 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
AI ChatBot for WordPress – WPBot
Affected
up to 5.5.7
What to do
Affects up to 5.5.7. Update AI ChatBot for WordPress – WPBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2024Cliengo – Chatbot: Unauthorized modification of dataCVE-2024-5993 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the session token of the chatbot.
Product
Cliengo – Chatbot
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Cliengo – Chatbot: Unauthorized modification of dataCVE-2024-5992 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot.
Product
Cliengo – Chatbot
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2024Cliengo – Chatbot: Cross-Site Request Forgery (CSRF)CVE-2024-37923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.
Product
Cliengo – Chatbot
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 27, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-4664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
WP Chat App
Fixed in
3.6.5
What to do
Update WP Chat App to 3.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.2.3
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2024Kognetiks Chatbot for: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kognetiks Kognetiks Chatbot for WordPress allows Stored XSS.This issue affects Kognetiks Chatbot for WordPress: from n/a through 1.9.8.
Product
Kognetiks Chatbot for
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Kognetiks Chatbot for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024Pure Chat: Cross-Site Request Forgery (CSRF)CVE-2024-35673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pure Chat by Ruby Pure Chat.This issue affects Pure Chat: from n/a through 2.22.
Product
Pure Chat
Affected
up to 2.22
What to do
Affects up to 2.22. Update Pure Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Simple Ajax Chat: Does not sanitise and escape some of its settingsCVE-2024-2470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Ajax Chat
Fixed in
20240412
What to do
Update Simple Ajax Chat to 20240412 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 22, 2024AI ChatBot: Unauthorized modification of dataCVE-2024-0453 · WordPress plugins & themes · reported by WordfenceMedium 5
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.
Product
AI ChatBot
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update AI ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024AI ChatBot: Unauthorized modification of dataCVE-2024-0452 · WordPress plugins & themes · reported by WordfenceMedium 5
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.
Product
AI ChatBot
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update AI ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024AI ChatBot: Unauthorized access of dataCVE-2024-0451 · WordPress plugins & themes · reported by WordfenceMedium 5
The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.
Product
AI ChatBot
Affected
up to 5.3.4
What to do
Affects up to 5.3.4. Update AI ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.