The ArtiBot Free Chat Bot for WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation (CWE-79). Authenticated administrators can inject malicious scripts via the plugin's admin settings, which execute when users access the affected pages. This vulnerability affects multi-site WordPress setups or installations with unfiltered_html disabled, impacting all plugin versions up to 1.1.6. The CVSS 3.1 score is 4.4 (medium), reflecting network attack vector, high attack complexity, required privileges at the administrator level, no user interaction, and partial confidentiality and integrity impact.

An authenticated attacker with administrator-level permissions can inject and store malicious scripts within the plugin's admin settings. These scripts execute in the context of users who visit the injected pages, potentially leading to partial confidentiality and integrity compromise. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the ArtiBot Free Chat Bot plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates regarding patches or official mitigations.