AI Chatbot & Workflow Automation by AIWU vulnerabilities

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.4.6. The `getCurrentTaskResults()` method is accessible without authentication or authorization checks, allowing unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data including OpenAI API keys in plaintext.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.12 is vulnerable to authorization bypass. This is due to improper verification of user authorization before performing actions.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.12 suffers from missing authorization in AJAX actions. Lack of capability checks and nonce verification allows unauthenticated attackers to delete specific records by ID or all records from any module's database table.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress up to version 1.4.14 contains a stored XSS vulnerability via the X-Forwarded-For header. An unauthenticated attacker can inject arbitrary JavaScript that executes whenever a user accesses the injected page. Note: practical exploitation is limited to 20 characters.