WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services has 45 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 45 are fixed as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 5 critical and 6 high. 2023 was the busiest year with 22 disclosures.

The most common weakness is Cross-Site Scripting, behind 18 of the records (40%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 45 issues recorded for WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services has a vendor fix available, so running the current release closes all known holes.

24 independent researchers contributed these findings, most of them (6) reported by Marco Wotschka. WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891030.08.2018Today27.01.20234.4ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting CVSS 4.4 · 27.01.20235.4ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset CVSS 5.4 · 27.01.202329.03.20235.4AI ChatBot <= 4.4.7 - Missing Authorization on openai_settings_option_callback CVSS 5.4 · 29.03.202312.04.20236.4ChatBot <= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback CVSS 6.4 · 12.04.20234.4AI ChatBot <= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 12.04.20239.8ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies CVSS 9.8 · 12.04.20236.5ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard CVSS 6.5 · 12.04.202320.04.20236.1ChatBot <= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery CVSS 6.1 · 20.04.202322.05.20234.4AI ChatBot <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 22.05.20234.4AI ChatBot <= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 22.05.202325.05.20234.4AI ChatBot <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 25.05.202308.08.20234.4ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings CVSS 4.4 · 08.08.20234.4ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder CVSS 4.4 · 08.08.202303.10.20235.3ChatBot <= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check CVSS 5.3 · 03.10.202311.10.20235.3AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions CVSS 5.3 · 11.10.20239.6AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file CVSS 9.6 · 11.10.20239.8AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response CVSS 9.8 · 11.10.20239.6AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file CVSS 9.6 · 11.10.20234.3AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions CVSS 4.3 · 11.10.20235.3AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user CVSS 5.3 · 11.10.202301.11.20234.4ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder CVSS 4.4 · 01.11.202323.11.20237.2ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection CVSS 7.2 · 23.11.202319.01.20249.8ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection CVSS 9.8 · 19.01.202421.05.20245.0AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback CVSS 5.0 · 21.05.20245.0AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback CVSS 5.0 · 21.05.20245.0AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback CVSS 5.0 · 21.05.202416.07.20245.5AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 5.5 · 16.07.202423.02.20258.8ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 23.02.202503.03.20254.4AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 03.03.202527.06.20255.4ChatBot <= 6.7.3 - Missing Authorization CVSS 5.4 · 27.06.202519.08.20254.4AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 19.08.202512.10.20255.3ChatBot <= 7.3.9 - Missing Authorization CVSS 5.3 · 12.10.202513.10.20254.3ChatBot <= 7.7.3 - Missing Authorization CVSS 4.3 · 13.10.202520.03.20267.5WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection CVSS 7.5 · 20.03.202623.04.20264.3WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization CVSS 4.3 · 23.04.202630.06.20264.3WPBot AI ChatBot <= 8.1.0 - Missing Authorization CVSS 4.3 · 30.06.20267.2WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter CVSS 7.2 · 30.06.202601.07.20266.1WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting CVSS 6.1 · 01.07.202606.07.20267.2WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 06.07.20264.9WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection CVSS 4.9 · 06.07.202615.07.20264.3WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function CVSS 4.3 · 15.07.20265.3WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter CVSS 5.3 · 15.07.202627.07.20265.3WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action CVSS 5.3 · 27.07.20265.3WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action CVSS 5.3 · 27.07.202608.09.20267.2WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter CVSS 7.2 · 08.09.2026

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

45

Get automatic notifications for all WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-22309

ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

45 records
2026-09-08 16:50CVE-2026-83593
7.2
High
IvayloYes
2026-07-27 23:30CVE-2026-16773
5.3
Medium
Wordfence PRISMYes
2026-07-27 23:29CVE-2026-16774
5.3
Medium
Wordfence PRISMYes
2026-07-15 19:50CVE-2026-15106
5.3
Medium
Wordfence PRISMYes
2026-07-15 19:49CVE-2026-15610
4.3
Medium
Wordfence PRISMYes
2026-07-06 00:00CVE-2026-57363
7.2
High
darooYes
2026-07-06 00:00CVE-2026-14189
4.9
Medium
Mustafa AhmedYes
2026-07-01 00:00CVE-2026-57362
6.1
Medium
Nguyen Dinh Hai (HaiND)Yes
2026-06-30 15:06CVE-2026-13731
7.2
High
Wordfence PRISMYes
2026-06-30 00:00CVE-2026-14185
4.3
Medium
Mustafa AhmedYes
Showing 1–10 of 45 reports
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services banner
Latestv8.7.7

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services

QuantumCloud

Author

QuantumCloud

4.7(123)
94/100
Last Updated
2026-09-11 (1d ago)
Active Installs
5,000+
Downloads
1,412,040
Requires WP
5.5+
Requires PHP
5.6+
Tested up to
WP 7.1
Created
2018-08-30 (8y ago)

AI ChatBot for WordPress – WPBot. Support, Sale, Convert, Automate WPBot is a feature rich AI ChatBot for WordPress websites. Provide 24/7 Automated Live Chat Support, Generate Leads and Convert, Collect Information, or Provide any type of AI Services you want. A Native, No code ChatBot for WordPress that can work with or without the AI LLM services. Support, Sale, Convert, or Provide any AI services with WPBot. 🔥 Feature Drop: AI Actions. Create AI Actions with Prompts. Some examples: Create Interactive Web Agency Quote Request, Lead Qualification, Real Estate Inquiry, Priority Support email, SaaS Demo Booking, E-Commerce Wholesale Inquiry, Legal Case Intake, Healthcare Booking, Event Planning, Auto Dealership, Education Admissions enrollment qualification, Job Assesment and Qualification etc. The possibilities are endless. 🔥 Feature Drop: WordPress Automations. The Automator brings visual workflow building to WordPress. Create sophisticated automations without writing a single line of code using our intuitive drag-and-drop interface. Build complex automations without any programming knowledge. Mltiple Triggers – WordPress actions, WooCommerce events, form submissions, and more. Powerful Actions – Create users, send emails, update posts, manage products, and more. Conditional Logic – Add filters and conditions to control workflow execution. Real-time Testing – Test your workflows before activating them Workflow Management – Organize, activate, deactivate, and duplicate workflows easily. ✅ WPbot can be powered by OpenAI ChatGPT, Gemini, OpenRouter (GPT, Claude, Grok, Cohere, DeepSeek, Mistral, Llama etc.), DialogFlow etc. Or simply use the built-in features to provide Automated Live Support, Convert Users, and collect data without any extra cost. 🔥 for Advanced Features Upgrade to WPBot Pro now! 🔥 Support, Bug Report, Feature Requests | ChatBot for WordPress Demo 💡 Do you need a ChatBot solution for Agency? Answer: WPBot Pro Master Lifetime deal is for you. White Labelling, 50 sites, Site Activation Control, One time payment – lifetime update, support, and more! 💡 Support customers on multiple channels with WPBot Pro. Your customers are everywhere. Now your chatbot is too. The WPBot ChatBot Pro versions can also support Messenger ChatBot, Instagram ChatBot, Telegram ChatBot, WhatsApp ChatBot, Zapier, WebHooks, Fluent CRM, Hubspot CRM etc. ✅ The ChatBot for WordPress WPBot can work both in Natural Language Processing Mode and Button Menu Driven Mode. WPBot is an AI-powered chatbot for online customer service, to answer user questions about your product or services, and also for Lead Generation and collecting data from the users using conversational forms addon for WPBot. Change all the WPBot live chat bot responses and make this work in any language with very little effort. RTL is supported. Use this handy ChatBot as a practical means for your website users to save time, improve engagement, generate leads, handle FAQs! It is also great as a HelpDesk, Contact Bot, FAQ Bot or feedback bot to increase user conversions and customer leads. ✅ WPBot pro is available with advanced features like Onsite, and Offsite Retargeting. Integrated Live Chat Support, Messenger ChatBot, Instagram ChatBot, WhatsApp ChatBot, White label chatbot, Chat history logs, analysis, AI Insights, MailChimp, Zapier, Webhook Integration and more! AI ChatBot plugin for WordPress websites WPBot Free version provides the following ChatBot features: Built-in, plug n’ play ChatBot features Supports any languages like French, Spanish etc., including RTL Create simple text responses easily from your WordPress backend Upload Custom Icons and Customize Colors to match your brand Show a List of FAQ or Frequently Asked Questions defined by you Let users email you any questions or feedback they may have Let users leave their phone number so you can call them back Option to display Start Menu After Greetings Create Conversational drag and drop forms with a free AddOn Integrate with Google’s Dialogflow Agent API to process natural language queries Limit AI Interactions by keywords in query Integrate with OpenRouter and use OpenAI, Anthropic, Google DeepMind, Meta, Mistral, Cohere, xAI, Perplexity AI, DeepSeek or any other popular AI services. Integrate with Google Gemini Supports RAG and Vector Database Embedding of Website Contents Display links to the relevant web pages on your website with all GPT responses Option for users to Like, Dislike, Share, or Report ChatBot responses What can you do with WPBot ChatBot? Use as scalable, automated live support system and personalized, live chat experiences Use this chatbot for lead generation with conversational forms Use this chatbot for scheduling appointments or booking Use this chatbot for lead generation and qualification Use as a FAQ chatbot for websites Use this ChatBot for reducing customer support response time Multilingual chatbot for international customers (Pro feature) Lower webpage bounce rate Longer user time on site Voice-enabled chatbot for customer service (Pro feature) Collect information and data from the website users Who can benefit from WPBot ChatBot? Chatbots can provide valuable benefits to a wide range of businesses by improving customer service, increasing efficiency, and enhancing user engagement. Here are some specific types of businesses that can significantly benefit from implementing chatbots: 🚀 ChatBot for E-commerce and Retail: – Customer Support: Provide 24/7 assistance, answer FAQs, track orders. – Sales Assistance: Offer product recommendations, show featured products, and support during the purchasing process. – Abandoned Cart Recovery: Engage customers who have abandoned their shopping carts with personalized messages and offers. 🚀 ChatBot for Healthcare Industry: – Appointment Scheduling: Automate the booking of appointments. – Patient Information: Provide initial information on symptoms, treatments, and healthcare services. 🚀 ChatBot for Financial Services and Banking: – Customer Service: Handle frequently asked questions, provide information on products and services, and assist with troubleshooting. – Loan and Credit Applications: Guide users through loan applications. 🚀 ChatBot for Real Estate: – Lead Generation: Qualify leads by answering property queries and scheduling viewings. – Customer Support with ChatBot: Provide information on property listings, market conditions, and financing options. – Virtual Property Tours: Offer virtual tours and answer questions about properties. 🚀 ChatBot for Travel and Hospitality Industry: – Booking Services: Automate booking of flights, hotels, and vacation packages. – Customer Support: Assist with cancellations and provide travel information. – Personalized Recommendations: Offer travel tips, destination information, and personalized vacation packages. 🚀 ChatBot for Education: – Student Support: Provide information on courses, application procedures, and campus life. – Tutoring: Offer automated tutoring sessions and study resources. – Administrative Assistance: Help with enrollment, scheduling 🚀 ChatBot for Human Resources (HR): – Recruitment: Screen candidates, schedule interviews, and answer job-related questions. – Employee Support: Assist with onboarding, provide HR policy information, and handle employee queries. – Performance Reviews: Automate the collection of feedback and performance reviews. 🚀 ChatBot for Customer Service-oriented Businesses: – Telecommunications: Handle billing inquiries, technical support, and service issues. – Utilities: Manage service requests, provide outage updates, and assist with billing inquiries. – Insurance: Help with policy information, claim processing, and provide quotes. 🚀 ChatBot for Marketing and Advertising: – Lead Generation: Qualify leads and collect customer information. – Engagement: Run interactive campaigns, quizzes, and promotions. – Customer Feedback: Collect feedback and conduct surveys to improve services. 🚀 ChatBot for Event Management: – Event Registration: Streamline the registration process for events, conferences, and webinars. – Attendee Engagement: Provide event schedules, speaker information, and answer attendee questions. – Feedback Collection: Gather feedback and reviews from event participants. 🚀 ChatBot for Restaurants and Food Services: – Order Placement: Automate the ordering process and provide menu recommendations. – Reservations: Handle table reservations. – Customer Feedback: Collect reviews and feedback from customers. WPBOT Pro Version WPBot Pro version is a multi-language supported chatbot. It is an affordable chatbot services for SMEs to provide multilingual chatbot for international customers. WPBot AI ChatBot Pro feature highlights Turn your website into an autonomous customer service and sales engine. WPBot Pro is a next-generation AI ChatBot plugin for WordPress that orchestrates multiple LLMs—including OpenAI ChatGPT, Claude, Gemini, DeepSeek, and Grok—alongside Google Dialogflow CX. Whether you need a RAG-driven knowledge base to answer customer questions, a visual drag-and-drop conversational form builder to capture leads, or an automated conversion tool to recover abandoned WooCommerce carts, WPBot Pro handles it natively from your dashboard. Next-Gen Multi-LLM & RAG AI Knowledge Base for Chatbot Advanced Multi-LLM Support: Connect seamlessly to OpenAI ChatGPT, Gemini, or use OpenRouter to access Claude, Grok, DeepSeek, Llama, and Mistral. RAG Vector Database Embeddings: Train your AI instantly by embedding your live website data, pages, posts, custom post types, or sitemap links into an active vector database. Document Data Training: Upload corporate training data, product catalogs, and user manuals directly as PDFs, XMLs, CSVs, or JSON files to build a highly contextual custom GPT Assistant. Interactive Conversational Forms & Lead Capture through Chatbot Drag-and-Drop Form Builder: Extend your chat’s start menu with a visual form workspace. Build dynamic contact intake, job applications, feedback surveys, and interactive calculators. Conditional Logic Pathways: Design menu-driven, branches-based conditional conversation tracks that replace old-school, static contact forms. Google Calendar Scheduling: Allow site visitors to book real-time appointments, consultations, and reservations directly inside the chat interface via Google Calendar. Instant Marketing Webhooks: Stream captured lead data, email lists, and customer phone numbers straight to any CRM or automated email application. High-ROI WooCommerce Sales & Cart Recovery Conversational E-Commerce: Integrate directly with your WooCommerce store to display product catalogs, featured items, flash sales, and active shipping order statuses in-chat. In-Widget Cart Conversions: Empower shoppers to search for items, view product details, and add products to their shopping cart without leaving the chat window. Offsite Abandoned Cart Recovery: Deploy automated tracking scripts to recapture lost revenue from shoppers who abandon checkout sessions on your site. Onsite Behavioral Retargeting with ChatBot Exit Intent & Scroll Triggers: Deploy behavioral marketing popups and custom chat messages when a user triggers exit intent, scrolls a specific percentage, or lingers on a page. Browser Tab Flashing: Recapture lost attention by flashing custom dynamic text strings in the visitor’s browser tab when they click away from your website. Extended UI Controls: Personalize extended home layouts, force the chat window to stay sticky during site browsing, or set the bot window to auto-open on first page load. Omnichannel Engagement & Live Chat Escalation Social Media Omnichannel Hub: Route, automate, and control incoming customer messages across Facebook Pages, Instagram, Messenger, WhatsApp, and Telegram profiles. Hybrid Human Escalation: Give users a clear pathway to transition from AI automation to a live human operator, handling responses via Slack or your WordPress dashboard. Voice-Enabled Conversational Tech for Chatbot Bi-Directional Voice Dictation: Provide hands-free accessibility by allowing customers to send spoken voice notes or dictate text, receiving audible, spoken responses back. ChatBot for Agencies – White Labeling & Deployment Unlimited Cross-Site Embeds: Install the plugin once and use standard JavaScript embed codes to inject your configured chatbot onto static HTML or external platforms. White-Label Agency Dashboard: Completely rebrand the backend administration menus and plugin identity to offer a premium, managed chat asset to your clients. Granular Session Logging: Control persistent user chat histories over single sessions, reset chat trees on page refresh, and access complete GDPR-compliant privacy data configurations. Deep Analytics & AI Interaction Insights Daily AI Summary Digests: Receive regular automated email summaries analyzing client behaviors and interactions to quickly identify flaws in your responses. Conversion Analytics: Access visual analytical charts mapping successful actions, user trends, and comprehensive feedback logs reporting liked or disliked chat interactions. ++ Download Free WPBot from GITHUB ++ Upgrade to WPBot Pro Now!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C