WordPress Plugin Vulnerabilities
qubotchat < 1.1.6 - Unauthenticated Stored XSS
Description
The plugin doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard.
Proof of Concept
1. Enter `#"><image src=/ onerror=alert("XSS")>` as the malicious payload into the chatbot input.
2. See XSS vulnerability. Affects Plugins
Fixed in version 1.1.6
References
Classification
Miscellaneous
Original Researcher
Rafael B.
Submitter
Rafael B.
Verified
Yes
Timeline
Publicly Published
2023-05-22 (about 4 months ago)
Added
2023-05-24 (about 4 months ago)
Last Updated
2023-05-25 (about 4 months ago)