Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:chatbot_with_chatgpt_wordpress:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductChatbot With Chatgpt Wordpress (b6124c60-d089-5512-a149-f5c310f76b5f)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-6847 vulnerable 2026-06-08 06:58:20.589746 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
Published: 2024-08-20T06:00:03.192Z
Updated: 2024-08-20T18:50:30.236Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6846 vulnerable 2026-06-08 06:58:20.589289 SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
Published: 2024-09-05T06:00:01.905Z
Updated: 2025-08-27T12:00:37.587Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6845 vulnerable 2026-06-08 06:58:20.587585 SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
Published: 2024-09-25T06:00:04.626Z
Updated: 2024-09-25T13:43:40.694Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-6843 vulnerable 2026-06-08 06:58:20.584237 SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSS
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Published: 2024-08-19T06:00:05.662Z
Updated: 2024-08-21T14:18:21.909Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.