Ai Marketing Expert Ai Email Marketing Ai Content Generator Seo Analyzer Ai Workflow Automation Social Media Ai Chatbot
Monthly
Stored DOM-based cross-site scripting in the WordPress plugin AI Marketing Expert (all versions up to and including 1.2.8) allows unauthenticated attackers to persist arbitrary JavaScript through the chatbot's unescaped 'name' parameter and have it execute in an administrator's browser. The storage path is reachable only when the chatbot module is active with at least one bot configured: the attacker writes the payload via three unauthenticated REST calls, and the dashboard widget's auto-poll then renders it when a logged-in admin opens wp-admin/index.php. Impact is bounded by that admin-only execution context (CVSS 7.2, scope-changed, low confidentiality/integrity), and no public exploit code was identified at time of analysis; a fixed release is available as version 1.2.9.
Stored DOM-based cross-site scripting in the WordPress plugin AI Marketing Expert (all versions up to and including 1.2.8) allows unauthenticated attackers to persist arbitrary JavaScript through the chatbot's unescaped 'name' parameter and have it execute in an administrator's browser. The storage path is reachable only when the chatbot module is active with at least one bot configured: the attacker writes the payload via three unauthenticated REST calls, and the dashboard widget's auto-poll then renders it when a logged-in admin opens wp-admin/index.php. Impact is bounded by that admin-only execution context (CVSS 7.2, scope-changed, low confidentiality/integrity), and no public exploit code was identified at time of analysis; a fixed release is available as version 1.2.9.