WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services

Software Type	Plugin
Software Slug	chatbot (view on wordpress.org)
Software Status	Active
Software Author	quantumcloud
Software Website	www.wpbot.pro
Software Downloads	1,447,183
Software Active Installs	5,000
Software Record Last Updated	October 10, 2026

Showing 1-20 of 48 Vulnerabilities

Submit a Vulnerability

WPBot 8.7.2 - 8.7.5 - Missing Authorization

4.3

CVE-2026-87959

Sep 14, 2026

Researcher: Sergey Mkrtchyan

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 - Missing Authorization

5.3

CVE-2026-87918

Sep 12, 2026

Researcher: Pedro Pinho

WPBot <= 8.5.9 - Unauthenticated Information Exposure

5.3

CVE-2026-87916

Sep 10, 2026

Researcher: Seongwon Lee

WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

7.2

CVE-2026-83593

Sep 8, 2026

Researcher: Ivaylo

WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

5.3

CVE-2026-16773

Jul 27, 2026

Researcher: Wordfence PRISM

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

5.3

CVE-2026-16774

Jul 27, 2026

Researcher: Wordfence PRISM

WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter

5.3

CVE-2026-15106

Jul 15, 2026

Researcher: Wordfence PRISM

WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

4.3

CVE-2026-15610

Jul 15, 2026

Researcher: Wordfence PRISM

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2026-57363

Jul 6, 2026

Researcher: daroo

WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection

4.9

CVE-2026-14189

Jul 6, 2026

Researcher: Mustafa Ahmed

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting

6.1

CVE-2026-57362

Jul 1, 2026

Researcher: Nguyen Dinh Hai (HaiND)

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

7.2

CVE-2026-13731

Jun 30, 2026

Researcher: Wordfence PRISM

WPBot AI ChatBot <= 8.1.0 - Missing Authorization

4.3

CVE-2026-14185

Jun 30, 2026

Researcher: Mustafa Ahmed

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization

4.3

CVE-2026-40788

Apr 23, 2026

Researcher: Mehdi Ouassou

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection

7.5

CVE-2026-32499

Mar 20, 2026

Researcher: Nguyen Ba Khanh

ChatBot <= 7.7.3 - Missing Authorization

4.3

CVE-2025-62952

Oct 13, 2025

Researcher: Legion Hunter

ChatBot <= 7.3.9 - Missing Authorization

5.3

CVE-2025-64277

Oct 12, 2025

Researcher: n0_arafat_n0

AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2025-9111

Aug 19, 2025

Researcher: Krugov Artyom

ChatBot <= 6.7.3 - Missing Authorization

5.4

CVE-2025-53200

Jun 27, 2025

Researcher: zaim

AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2025-0329

Mar 3, 2025

Researcher: Bob Matyas

Title	Status	CVE ID	CVSS	Researchers	Date
WPBot 8.7.2 - 8.7.5 - Missing Authorization	Patched	CVE-2026-87959	4.3	Sergey Mkrtchyan	September 14, 2026
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 - Missing Authorization	Patched	CVE-2026-87918	5.3	Pedro Pinho	September 12, 2026
WPBot <= 8.5.9 - Unauthenticated Information Exposure	Patched	CVE-2026-87916	5.3	Seongwon Lee	September 10, 2026
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter	Patched	CVE-2026-83593	7.2	Ivaylo	September 8, 2026
WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action	Patched	CVE-2026-16773	5.3	Wordfence PRISM	July 27, 2026
WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action	Patched	CVE-2026-16774	5.3	Wordfence PRISM	July 27, 2026
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter	Patched	CVE-2026-15106	5.3	Wordfence PRISM	July 15, 2026
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function	Patched	CVE-2026-15610	4.3	Wordfence PRISM	July 15, 2026
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2026-57363	7.2	daroo	July 6, 2026
WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection	Patched	CVE-2026-14189	4.9	Mustafa Ahmed	July 6, 2026
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting	Patched	CVE-2026-57362	6.1	Nguyen Dinh Hai (HaiND)	July 1, 2026
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter	Patched	CVE-2026-13731	7.2	Wordfence PRISM	June 30, 2026
WPBot AI ChatBot <= 8.1.0 - Missing Authorization	Patched	CVE-2026-14185	4.3	Mustafa Ahmed	June 30, 2026
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization	Patched	CVE-2026-40788	4.3	Mehdi Ouassou	April 23, 2026
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection	Patched	CVE-2026-32499	7.5	Nguyen Ba Khanh	March 20, 2026
ChatBot <= 7.7.3 - Missing Authorization	Patched	CVE-2025-62952	4.3	Legion Hunter	October 13, 2025
ChatBot <= 7.3.9 - Missing Authorization	Patched	CVE-2025-64277	5.3	n0_arafat_n0	October 12, 2025
AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2025-9111	4.4	Krugov Artyom	August 19, 2025
ChatBot <= 6.7.3 - Missing Authorization	Patched	CVE-2025-53200	5.4	zaim	June 27, 2025
AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2025-0329	4.4	Bob Matyas	March 3, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation