Plugin security history

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with WPBot – AI ChatBot for Live Support, Lead Generation, AI Services, published between 2023 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records

5Critical

5High

34Medium

0Low

0Informational

44Patched records

0Currently marked unpatched

2023-01-27First disclosure

2026-07-27Latest disclosure

43 of 44CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	22	22 records
2024	5	5 records
2025	6	6 records
2026	11	11 records

Severity Breakdown

Severity	Records	Share
Critical	5	11.4%
High	5	11.4%
Medium	34	77.3%

Vulnerability-Type Breakdown

Cross-Site Scripting

17 records38.6%

First: 2023. Latest: 2026.

Missing Authorization

10 records22.7%

First: 2023. Latest: 2026.

SQL Injection

4 records9.1%

First: 2023. Latest: 2026.

CSRF

3 records6.8%

First: 2023. Latest: 2023.

Other

3 records6.8%

First: 2023. Latest: 2025.

Privilege Escalation

3 records6.8%

First: 2024. Latest: 2024.

Path Traversal

2 records4.5%

First: 2023. Latest: 2023.

Information Disclosure

2 records4.5%

First: 2023. Latest: 2026.

Patch Status

Patched: 44
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

8.6.0
8.5.7
8.3.8
8.5.2
8.3.3
8.5.0
8.2.0
7.9.9
7.8.0
7.7.4
7.4.0
7.1.0
6.7.5
6.2.4
6.3.6
5.5.8
5.3.6
5.1.1
4.9.7
4.9.3
4.9.1
4.7.9
4.7.8
4.5.6
4.5.5
4.6.1
4.4.5
4.5.1
4.4.9
4.4.7
4.4.8
4.3.1
4.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`4.9.2`	AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions	October 11, 2023	4.9.1, 4.9.3	Medium
`*-4.8.9`	AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions	October 11, 2023	4.9.1, 4.9.3	Medium
`4.9.2`	AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions	October 11, 2023	4.9.1, 4.9.3	Medium
`*-4.8.9`	AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions	October 11, 2023	4.9.1, 4.9.3	Medium
`4.9.2`	AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file	October 11, 2023	4.9.1, 4.9.3	Critical
`*-4.8.9`	AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file	October 11, 2023	4.9.1, 4.9.3	Critical
`*-4.8.9`	AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response	October 11, 2023	4.9.1	Critical
`4.9.2`	AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file	October 11, 2023	4.9.1, 4.9.3	Critical
`*-4.8.9`	AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file	October 11, 2023	4.9.1, 4.9.3	Critical
`*-4.7.8`	ChatBot <= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check	October 3, 2023	4.7.9	Medium
`*-4.7.7`	ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder	August 8, 2023	4.7.8	Medium
`*-4.7.7`	ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings	August 8, 2023	4.7.8	Medium
`*-4.5.5`	AI ChatBot <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 25, 2023	4.5.6	Medium
`*-4.5.4`	AI ChatBot <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 22, 2023	4.5.5	Medium
`*-4.6.0`	AI ChatBot <= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 22, 2023	4.6.1	Medium
`*-4.4.4`	ChatBot <= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery	April 20, 2023	4.4.5	Medium
`*-4.4.8`	ChatBot <= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback	April 12, 2023	4.4.9	Medium
`*-4.4.9`	AI ChatBot <= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting	April 12, 2023	4.5.1	Medium
`*-4.4.8`	ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard	April 12, 2023	4.4.9	Medium
`*-4.4.6`	ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies	April 12, 2023	4.4.7	Critical
`*-4.4.7`	AI ChatBot <= 4.4.7 - Missing Authorization on openai_settings_option_callback	March 29, 2023	4.4.8	Medium
`*-4.3.0`	ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting	January 27, 2023	4.3.1	Medium
`*-4.2.8`	ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset	January 27, 2023	4.2.9	Medium

Selected source records

Latest Records

MediumCVE-2026-16773

WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

Published: July 27, 2026

Affected versions: *-8.5.9
Patched versions: 8.6.0

Original Wordfence record

MediumCVE-2026-16774

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

Published: July 27, 2026

Affected versions: *-8.5.9
Patched versions: 8.6.0

Original Wordfence record

MediumCVE-2026-15106

WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter

Published: July 15, 2026

Affected versions: *-8.5.6
Patched versions: 8.5.7

Original Wordfence record

MediumCVE-2026-15610

WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

Published: July 15, 2026

Affected versions: *-8.5.6
Patched versions: 8.5.7

Original Wordfence record

MediumCVE-2026-14189

WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection

Published: July 6, 2026

Affected versions: *-8.5.1
Patched versions: 8.5.2

Original Wordfence record

HighCVE-2026-57363

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting

Published: July 6, 2026

Affected versions: *-8.3.7
Patched versions: 8.3.8

Original Wordfence record

MediumCVE-2026-57362

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting

Published: July 1, 2026

Affected versions: *-8.3.2
Patched versions: 8.3.3

Original Wordfence record

HighCVE-2026-13731

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

Published: June 30, 2026

Affected versions: *-8.4.9
Patched versions: 8.5.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-1650

ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies

Published: April 12, 2023

Affected versions: *-4.4.6
Patched versions: 4.4.7

Original Wordfence record

CriticalCVE-2023-5204

AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

Published: October 11, 2023

Affected versions: *-4.8.9
Patched versions: 4.9.1

Original Wordfence record

CriticalCVE-2024-22309

ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection

Published: January 19, 2024

Affected versions: *-5.1.0
Patched versions: 5.1.1

Original Wordfence record

CriticalCVE-2023-5241

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Published: October 11, 2023

Affected versions: *-4.8.9; 4.9.2
Patched versions: 4.9.1, 4.9.3

Original Wordfence record

CriticalCVE-2023-5212

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

Published: October 11, 2023

Affected versions: *-4.8.9; 4.9.2
Patched versions: 4.9.1, 4.9.3

Original Wordfence record

HighCVE-2025-26932

ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion

Published: February 23, 2025

Affected versions: *-6.3.5
Patched versions: 6.3.6

Original Wordfence record

HighCVE-2026-32499

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection

Published: March 20, 2026

Affected versions: *-7.7.9
Patched versions: 7.8.0

Original Wordfence record

HighCVE-2026-13731

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

Published: June 30, 2026

Affected versions: *-8.4.9
Patched versions: 8.5.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory