CVE-2023-1011: Quantumcloud Wpbot

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.

Affected products

• Quantumcloud Wpbot: before 4.4.5 (fixed in 4.4.5)

Published 2023-05-08. Last modified 2026-06-17.