Plugin security history

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with WPBot – AI ChatBot for Live Support, Lead Generation, AI Services, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

5Critical

5High

34Medium

0Low

0Informational

44Patched records

0Currently marked unpatched

2023-01-27First disclosure

2026-07-27Latest disclosure

43 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	22	22 records
2024	5	5 records
2025	6	6 records
2026	11	11 records

Severity Breakdown

Severity	Records	Share
Critical	5	11.4%
High	5	11.4%
Medium	34	77.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

17 records38.6%

First: 2023. Latest: 2026.

Missing Authorization

10 records22.7%

First: 2023. Latest: 2026.

SQL Injection

4 records9.1%

First: 2023. Latest: 2026.

CSRF

3 records6.8%

First: 2023. Latest: 2023.

Other

3 records6.8%

First: 2023. Latest: 2025.

Privilege Escalation

3 records6.8%

First: 2024. Latest: 2024.

Path Traversal

2 records4.5%

First: 2023. Latest: 2023.

Information Disclosure

2 records4.5%

First: 2023. Latest: 2026.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

8.6.0
8.5.7
8.3.8
8.5.2
8.3.3
8.5.0
8.2.0
7.9.9
7.8.0
7.7.4
7.4.0
7.1.0
6.7.5
6.2.4
6.3.6
5.5.8
5.3.6
5.1.1
4.9.7
4.9.3
4.9.1
4.7.9
4.7.8
4.5.6
4.5.5
4.6.1
4.4.5
4.5.1
4.4.9
4.4.7
4.4.8
4.3.1
4.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-8.5.9`	WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action	July 27, 2026	8.6.0	Medium
`*-8.5.9`	WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action	July 27, 2026	8.6.0	Medium
`*-8.5.6`	WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter	July 15, 2026	8.5.7	Medium
`*-8.5.6`	WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function	July 15, 2026	8.5.7	Medium
`*-8.3.7`	WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting	July 6, 2026	8.3.8	High
`*-8.5.1`	WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection	July 6, 2026	8.5.2	Medium
`*-8.3.2`	WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting	July 1, 2026	8.3.3	Medium
`*-8.4.9`	WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter	June 30, 2026	8.5.0	High
`*-8.1.0`	WPBot AI ChatBot <= 8.1.0 - Missing Authorization	June 30, 2026	8.2.0	Medium
`*-7.9.7`	WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization	April 23, 2026	7.9.9	Medium
`*-7.7.9`	WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection	March 20, 2026	7.8.0	High
`*-7.7.3`	ChatBot <= 7.7.3 - Missing Authorization	October 13, 2025	7.7.4	Medium
`*-7.3.9`	ChatBot <= 7.3.9 - Missing Authorization	October 12, 2025	7.4.0	Medium
`*-7.0.0`	AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting	August 19, 2025	7.1.0	Medium
`*-6.7.3`	ChatBot <= 6.7.3 - Missing Authorization	June 27, 2025	6.7.5	Medium
`*-6.2.3`	AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting	March 3, 2025	6.2.4	Medium
`*-6.3.5`	ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion	February 23, 2025	6.3.6	High
`*-5.5.7`	AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	July 16, 2024	5.5.8	Medium
`*-5.3.4`	AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback	May 21, 2024	5.3.6	Medium
`*-5.3.4`	AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback	May 21, 2024	5.3.6	Medium
`*-5.3.4`	AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback	May 21, 2024	5.3.6	Medium
`*-5.1.0`	ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection	January 19, 2024	5.1.1	Critical
`*-4.7.8`	ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection	November 23, 2023	4.7.9	High
`4.8.6-4.9.6`	ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder	November 1, 2023	4.9.7	Medium
`*-4.8.9`	AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user	October 11, 2023	4.9.1	Medium

Selected source records

Latest Records

MediumCVE-2026-16773

WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

Published: July 27, 2026

Affected versions: *-8.5.9
Patched versions: 8.6.0

Original Wordfence record

MediumCVE-2026-16774

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

Published: July 27, 2026

Affected versions: *-8.5.9
Patched versions: 8.6.0

Original Wordfence record

MediumCVE-2026-15106

WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter

Published: July 15, 2026

Affected versions: *-8.5.6
Patched versions: 8.5.7

Original Wordfence record

MediumCVE-2026-15610

WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

Published: July 15, 2026

Affected versions: *-8.5.6
Patched versions: 8.5.7

Original Wordfence record

MediumCVE-2026-14189

WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection

Published: July 6, 2026

Affected versions: *-8.5.1
Patched versions: 8.5.2

Original Wordfence record

HighCVE-2026-57363

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-8.3.7
Patched versions: 8.3.8

Original Wordfence record

MediumCVE-2026-57362

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting

Published: July 1, 2026

Affected versions: *-8.3.2
Patched versions: 8.3.3

Original Wordfence record

HighCVE-2026-13731

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

Published: June 30, 2026

Affected versions: *-8.4.9
Patched versions: 8.5.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-1650

ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies

Published: April 12, 2023

Affected versions: *-4.4.6
Patched versions: 4.4.7

Original Wordfence record

CriticalCVE-2023-5204

AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

Published: October 11, 2023

Affected versions: *-4.8.9
Patched versions: 4.9.1

Original Wordfence record

CriticalCVE-2024-22309

ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection

Published: January 19, 2024

Affected versions: *-5.1.0
Patched versions: 5.1.1

Original Wordfence record

CriticalCVE-2023-5241

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Published: October 11, 2023

Affected versions: *-4.8.9; 4.9.2
Patched versions: 4.9.1, 4.9.3

Original Wordfence record

CriticalCVE-2023-5212

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

Published: October 11, 2023

Affected versions: *-4.8.9; 4.9.2
Patched versions: 4.9.1, 4.9.3

Original Wordfence record

HighCVE-2025-26932

ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion

Published: February 23, 2025

Affected versions: *-6.3.5
Patched versions: 6.3.6

Original Wordfence record

HighCVE-2026-32499

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection

Published: March 20, 2026

Affected versions: *-7.7.9
Patched versions: 7.8.0

Original Wordfence record

HighCVE-2026-13731

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

Published: June 30, 2026

Affected versions: *-8.4.9
Patched versions: 8.5.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory