What’s Vulnerable › Products
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services vulnerabilities
33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Latest quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services vulnerabilities
- CVE-2026-83593 — WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (CVSS 7.2)
- CVE-2026-16774 — WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action (CVSS 5.3)
- CVE-2026-16773 — WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action (CVSS 5.3)
- CVE-2026-15610 — WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function (CVSS 4.3)
- CVE-2026-15106 — WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter (CVSS 5.3)
- CVE-2026-13731 — WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (CVSS 7.2)
- CVE-2025-9111 — WPBOT < 7.1.0 - Admin+ Stored XSS (CVSS 3.5)
- CVE-2025-0329 — AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2024-6669 — AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2024-0453 — AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback (CVSS 7.7)
- CVE-2024-0452 — AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback (CVSS 7.7)
- CVE-2024-0451 — AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback (CVSS 5.0)
- CVE-2024-22309 — WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection (CVSS 9.8)
- CVE-2023-48741 — WordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection (CVSS 7.2)
- CVE-2023-5606 — (CVSS 4.8)
- CVE-2023-5534 — AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions (CVSS 5.4)
- CVE-2023-5533 — AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions (CVSS 9.8)
- CVE-2023-5254 — AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user (CVSS 5.3)
- CVE-2023-5241 — AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file (CVSS 8.1)
- CVE-2023-5212 — AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file (CVSS 8.1)
- CVE-2023-5204 — AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response (CVSS 7.5)
- CVE-2023-44993 — WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2023-4254 — Chatbot < 4.7.8 - Admin+ Stored XSS in Language Settings (CVSS 4.8)
- CVE-2023-4253 — Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder (CVSS 4.8)
- CVE-2023-3175 — AI ChatBot < 4.6.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)