CVE-2023-1651: Quantumcloud Wpbot

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS

Affected products

• Quantumcloud Wpbot: before 4.4.9 (fixed in 4.4.9)

Published 2023-05-08. Last modified 2026-06-17.