WordPress plugin
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 48 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical5
- High6
- Medium37
- Low0
All WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities
- Medium4.38.7.5 - Missing Authorization
8.7.2 – 8.7.5Update to 8.7.6
- Medium5.3Missing Authorization
<8.5.7Update to 8.5.7
- Medium5.3Unauthenticated Information Exposure
≤8.5.9Update to 8.6.0
- High7.2Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
≤8.7.3Update to 8.7.4
- Medium5.3Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
≤8.5.9Update to 8.6.0
- Medium5.3Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
≤8.5.9Update to 8.6.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
≤8.5.6Update to 8.5.7
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
≤8.5.6Update to 8.5.7
- Medium4.9Authenticated (Administrator+) SQL Injection
≤8.5.1Update to 8.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤8.3.7Update to 8.3.8
- Medium6.1Reflected Cross-Site Scripting
≤8.3.2Update to 8.3.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
≤8.4.9Update to 8.5.0
- Medium4.3Missing Authorization
≤8.1.0Update to 8.2.0
- Medium4.3Missing Authorization
≤7.9.7Update to 7.9.9
- High7.5Unauthenticated SQL Injection
≤7.7.9Update to 7.8.0
- Medium4.3Missing Authorization
≤7.7.3Update to 7.7.4
- Medium5.3Missing Authorization
≤7.3.9Update to 7.4.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤7.0.0Update to 7.1.0
- Medium5.4Missing Authorization
≤6.7.3Update to 6.7.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤6.2.3Update to 6.2.4
- High8.8Authenticated (Contributor+) Local File Inclusion
≤6.3.5Update to 6.3.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.5.7Update to 5.5.8
- Medium5.0Missing Authorization via openai_file_delete_callback
≤5.3.4Update to 5.3.6
- Medium5.0Missing Authorization via openai_file_upload_callback
≤5.3.4Update to 5.3.6
- Medium5.0Missing Authorization via openai_file_list_callback
≤5.3.4Update to 5.3.6
- Critical9.8Unauthenticated PHP Object Injection
≤5.1.0Update to 5.1.1
- High7.2Authenticated (Administrator+) SQL Injection
≤4.7.8Update to 4.7.9
- Medium4.44.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
4.8.6 – 4.9.6Update to 4.9.7
- Critical9.8Unauthenticated SQL Injection via qc_wpbo_search_response
≤4.8.9Update to 4.9.1
- Medium4.3Cross-Site Request Forgery on AJAX actions
≤4.9.2Update to 4.9.1 or 4.9.3
- Medium5.3Missing Authorization on AJAX actions
≤4.9.2Update to 4.9.1 or 4.9.3
- Medium5.3Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user
≤4.8.9Update to 4.9.1
- Critical9.6Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
≤4.9.2Update to 4.9.1 or 4.9.3
- Critical9.6AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
≤4.9.2Update to 4.9.1 or 4.9.3
- Medium5.3Cross-Site Request Forgery via qc_wp_latest_update_check
≤4.7.8Update to 4.7.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
≤4.7.7Update to 4.7.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings
≤4.7.7Update to 4.7.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.5.5Update to 4.5.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.6.0Update to 4.6.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.5.4Update to 4.5.5
- Medium6.1Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery
≤4.4.4Update to 4.4.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback
≤4.4.8Update to 4.4.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤4.4.9Update to 4.5.1
- Critical9.8Unauthenticated PHP Object Injection via Cookies
≤4.4.6Update to 4.4.7
- Medium6.5Unauthenticated Stored Cross-Site Scripting in Admin Dashboard
≤4.4.8Update to 4.4.9
- Medium5.4Missing Authorization on openai_settings_option_callback
≤4.4.7Update to 4.4.8
- Medium4.4Authenticated (Admin+) Cross-Site Scripting
≤4.3.0Update to 4.3.1
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset
≤4.2.8Update to 4.2.9
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services: common questions
Does WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services have known vulnerabilities?
Yes. VulnCrest Radar lists 48 known vulnerabilities in WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services: 5 critical, 6 high, 37 medium. None are known to affect version null.
How do I check which version of WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability?
CVE-2026-87959, published Sep 14, 2026: WPBot 8.7.2 - 8.7.5 - Missing Authorization. Severity: Medium (CVSS 4.3).
Is any WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability listed in CISA KEV?
No. None of the known WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities is currently listed in the CISA KEV catalog.