Stored Cross-Site Scripting Vulnerability in ArtiBot Free Chat Bot Plugin for WordPress

CVE-2024-0449

Summary

The ArtiBot Free Chat Bot for WordPress plugin contains a vulnerability that allows authenticated users with administrator-level permissions to conduct stored cross-site scripting attacks. Due to inadequate input sanitization and output escaping within the admin settings, these users can inject malicious scripts into pages. Consequently, these scripts execute whenever a user visits an affected page. This issue primarily affects multi-site installations and those configurations where unfiltered_html is disabled, exposing users to potential data theft and compromised session integrity.

References