WordPress wpbot has 12 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-1650 | The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, whi | critical | 9.8 | <4.4.7 | 4.4.7 |
| CVE-2023-3175 | The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perfor | medium | 4.8 | <4.6.1 | 4.6.1 |
| CVE-2023-4253 | The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | <4.7.8 | 4.7.8 |
| CVE-2023-4254 | The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such | medium | 4.8 | <4.7.8 | 4.7.8 |
| CVE-2023-2742 | The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perfo | medium | 4.8 | <4.5.5 | 4.5.5 |
| CVE-2023-1649 | The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users s | medium | 4.8 | <4.5.1 | 4.5.1 |
| CVE-2023-2811 | The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users s | medium | 4.8 | <4.5.6 | 4.5.6 |
| CVE-2023-1660 | The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated use | medium | 6.1 | <4.4.9 | 4.4.9 |
| CVE-2025-0329 | The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privil | medium | 4.8 | <6.2.4 | 6.2.4 |
| CVE-2025-9111 | The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privil | low | 3.5 | <7.1.0 | 7.1.0 |
| CVE-2023-1651 | The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settin | medium | 5.4 | <4.4.9 | 4.4.9 |
| CVE-2023-1011 | The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not | medium | 6.1 | <4.4.5 | 4.4.5 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked