The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ai_chatbot | Quantumcloud | * | 4.4.9 (excluding) |