CVE-2024-10684: fallo de gravedad media en Kognetiks Chatbot for WordPress
Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.4%
The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dir' parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
kognetiks · Kognetiks Chatbot for WordPressCVEs relacionadas — Kognetiks Chatbot for WordPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-4560CRITICALKognetiks Chatbot for WordPress <= 1.9.9 - Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant FunctionEPSS 0.9%CVE-2024-10529MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant DeletionEPSS 0.5%CVE-2024-10531MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant UpdateEPSS 0.5%CVE-2026-32579CRITICALWordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerabilityEPSS 0.5%CVE-2024-10530MEDIUMKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant AdditionEPSS 0.4%CVE-2025-11256MEDIUMKognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation ErasingEPSS 0.4%