WordPress plugin

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services security & vulnerabilities

Q: Does WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services have known vulnerabilities?

Yes. VulnCrest Radar lists 48 known vulnerabilities in WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services: 5 critical, 6 high, 37 medium. None are known to affect version null.

Q: How do I check which version of WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability?

CVE-2026-87959, published Sep 14, 2026: WPBot 8.7.2 - 8.7.5 - Missing Authorization. Severity: Medium (CVSS 4.3).

Q: Is any WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability listed in CISA KEV?

No. None of the known WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities is currently listed in the CISA KEV catalog.

chatbot— active installsLast vulnerability Sep 14, 2026

No known unpatched vulnerabilities in the latest version

All 48 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

48Known vulnerabilities

Critical5
High6
Medium37
Low0

Vulnerabilities per year

All WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter ≤8.7.3Update to 8.7.4	CVE-2026-83593	Sep 08
High7.2	Unauthenticated Stored Cross-Site Scripting ≤8.3.7Update to 8.3.8	CVE-2026-57363	Jul 06
High7.2	Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter ≤8.4.9Update to 8.5.0	CVE-2026-13731	Jun 30
High7.5	Unauthenticated SQL Injection ≤7.7.9Update to 7.8.0	CVE-2026-32499	Mar 20
High8.8	Authenticated (Contributor+) Local File Inclusion ≤6.3.5Update to 6.3.6	CVE-2025-26932	Feb 23, 2025
Critical9.8	Unauthenticated PHP Object Injection ≤5.1.0Update to 5.1.1	CVE-2024-22309	Jan 19, 2024
High7.2	Authenticated (Administrator+) SQL Injection ≤4.7.8Update to 4.7.9	CVE-2023-48741	Nov 23, 2023
Critical9.8	Unauthenticated SQL Injection via qc_wpbo_search_response ≤4.8.9Update to 4.9.1	CVE-2023-5204	Oct 11, 2023
Critical9.6	Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file ≤4.9.2Update to 4.9.1 or 4.9.3	CVE-2023-5241	Oct 11, 2023
Critical9.6	AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file ≤4.9.2Update to 4.9.1 or 4.9.3	CVE-2023-5212	Oct 11, 2023
Critical9.8	Unauthenticated PHP Object Injection via Cookies ≤4.4.6Update to 4.4.7	CVE-2023-1650	Apr 12, 2023

High7.2
Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
≤8.7.3Update to 8.7.4
CVE-2026-83593Sep 08
High7.2
Unauthenticated Stored Cross-Site Scripting
≤8.3.7Update to 8.3.8
CVE-2026-57363Jul 06
High7.2
Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
≤8.4.9Update to 8.5.0
CVE-2026-13731Jun 30
High7.5
Unauthenticated SQL Injection
≤7.7.9Update to 7.8.0
CVE-2026-32499Mar 20
High8.8
Authenticated (Contributor+) Local File Inclusion
≤6.3.5Update to 6.3.6
CVE-2025-26932Feb 23, 2025
Critical9.8
Unauthenticated PHP Object Injection
≤5.1.0Update to 5.1.1
CVE-2024-22309Jan 19, 2024
High7.2
Authenticated (Administrator+) SQL Injection
≤4.7.8Update to 4.7.9
CVE-2023-48741Nov 23, 2023
Critical9.8
Unauthenticated SQL Injection via qc_wpbo_search_response
≤4.8.9Update to 4.9.1
CVE-2023-5204Oct 11, 2023
Critical9.6
Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
≤4.9.2Update to 4.9.1 or 4.9.3
CVE-2023-5241Oct 11, 2023
Critical9.6
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
≤4.9.2Update to 4.9.1 or 4.9.3
CVE-2023-5212Oct 11, 2023
Critical9.8
Unauthenticated PHP Object Injection via Cookies
≤4.4.6Update to 4.4.7
CVE-2023-1650Apr 12, 2023

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services: common questions

Does WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services have known vulnerabilities?

Yes. VulnCrest Radar lists 48 known vulnerabilities in WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services: 5 critical, 6 high, 37 medium. None are known to affect version null.

How do I check which version of WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability?

CVE-2026-87959, published Sep 14, 2026: WPBot 8.7.2 - 8.7.5 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerability listed in CISA KEV?

No. None of the known WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services vulnerabilities is currently listed in the CISA KEV catalog.