CVE-2023-5606

The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2987335%40chatbot%2Ftrunk&old=2986133%40chatbot%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=cveThird Party Advisory

Published

Nov 2, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5599A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
• CVE-2023-5600An issue has been discovered in GitLab EE affecting all vers…3.1
• CVE-2023-5601The WooCommerce Ninja Forms Product Add-ons WordPress plugin…9.8
• CVE-2023-5602The Social Media Share Buttons & Social Sharing Icons plugin…8.8
• CVE-2023-5604The Asgaros Forum WordPress plugin before 2.7.1 allows forum…9.8
• CVE-2023-5605The URL Shortify WordPress plugin before 1.7.9.1 does not sa…4.8
• CVE-2023-5607 An improper limitation of a path name to a restricted direc…7.2
• CVE-2023-5609The Seraphinite Accelerator WordPress plugin before 2.2.29 d…6.1
• CVE-2023-5610The Seraphinite Accelerator WordPress plugin before 2.2.29 d…5.4
• CVE-2023-5611The Seraphinite Accelerator WordPress plugin before 2.20.32 …5.3
• CVE-2023-5612An issue has been discovered in GitLab affecting all version…5.3
• CVE-2023-5613The Super Testimonials plugin for WordPress is vulnerable to…5.4