What’s Vulnerable › Vulnerabilities

CVE-2023-2399: qubotchat < 1.1.6 - Unauthenticated Stored XSS

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-19 · updated 2026-06-17

Description

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard.

Affected products

• QuBot: before 1.1.6 — fixed in 1.1.6

How to fix

Upgrade to a fixed version: QuBot 1.1.6. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d
• https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d
• https://wpscan.com/vulnerability/deca3cd3-f7cf-469f-9f7e-3612f7ae514d/

Get alerted when CVE-2023-2399 or the next vulnerability affects your stack