title: ChatBot < 4.4.9 - Unauthenticated Stored XSS
description: The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: AI ChatBot
versions:
status: affected, versionType: custom, version: 0, lessThan: 4.4.9
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}