Skip to content
OpenAdvisories
High · 7.2 Scanner template CVE-2026-13731 EUVD-2026-40889GHSA-x882-f7rv-28ch

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by Wordfence

Vendor: Quantum Cloud Product: WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Category: Web / CMS

Description

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.

Affected products

VendorProductAffectedFixed
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services ≤ 8.4.9 —

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References