CVE-2023-5254mediumCWE-200

CVE-2023-5254: fallo de gravedad media en quantumcloud WPBot – AI ChatBot for Live…

AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.9%
The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a user name exists on the site as well as order information for existing users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
quantumcloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
CVEs relacionadas — quantumcloud WPBot – AI ChatBot for Live…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-5204CRITICALAI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_responseEPSS 7.8%CVE-2023-5241CRITICALAI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_fileEPSS 2.6%CVE-2023-5212CRITICALAI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_fileEPSS 2.0%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-5533MEDIUMAI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actionsEPSS 0.6%CVE-2026-83593HIGHWPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.5%