Wpbot vulnerabilities
8 known vulnerabilities in Wpbot from QuantumCloud. 8 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
WPBot – AI ChatBot for Live Support, Lead…: Missing Authorization
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers
- 7.7 High severity
WPBot – AI ChatBot for Live Support, Lead…: Missing Authorization
The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers
- 7.2 High severity
AI ChatBot: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud AI ChatBot.This issue affects AI ChatBot: from n/a through 4.7.8.
- 9.8 Critical severity
WPBot – AI ChatBot for Live Support, Lead…: Missing Authorization
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers
- 8.1 High severity
WPBot – AI ChatBot for Live Support, Lead…: Improper Limitation of a Pathname to a Restricted Directory
The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on t
- 8.1 High severity
WPBot – AI ChatBot for Live Support, Lead…: Improper Limitation of a Pathname to a Restricted Directory
The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server
- 7.5 High severity
WPBot – AI ChatBot for Live Support, Lead…: Improper Neutralization of Special Elements used in an SQL Command
The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make
- 9.8 Critical severity
AI ChatBot: Deserialization of Untrusted Data
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog