WPBot

WPBot through 8.5.9 registers wpcs_send_email() as both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email without a nonce, capability check or rate limit. An unauthenticated attacker can submit data[to], data[subject] and data[message] to admin-ajax.php?action=wpcs_send_email; the handler passes those values to wp_mail() using a sender address from the site's domain. This permits spam and phishing through the site and can damage its domain or IP reputation. Actual delivery remains dependent on the site's mail configuration. Version 8.6.0 removes logged-out access, requires manage_options and a nonce, and restricts recipients.

WPBot through 8.5.9 registers both qcld_chatbot_session_date_filter and wpbot_send_email_transcript for unauthenticated admin-ajax use without a nonce or capability check. An unauthenticated attacker can submit start_date and end_date to qcld_chatbot_session_date_filter_free() and receive rows from wpbot_user, including session identifiers and stored user data, then submit a selected session plus an attacker-controlled email to wpbot_send_email_transcript_free(). That function reads the matching wpbot_user and wpbot_conversation rows and sends the full transcript with wp_mail() to the supplied address, exposing chat content and associated PII. Version 8.6.0 removes both nopriv registrations, requires manage_options plus an AJAX nonce, and sends transcripts only to the address stored for the session.

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 8.5.6.

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 8.5.6.

ChatBot is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 8.3.7.

ChatBot is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 8.3.2.

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 8.4.9.

ChatBot is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 7.9.7.

ChatBot is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through <= 7.7.9.

ChatBot is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

ChatBot is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

ChatBot is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

ChatBot is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

AI ChatBot for WordPress – WPBot is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

AI ChatBot is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

AI ChatBot is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

AI ChatBot is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

ChatBot with AI is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Chatbot for is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

AI ChatBot is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

ChatBot is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

Chatbot is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

AI ChatBot is affected by arbitrary file deletion. Exploitation requires an authenticated WordPress account. A successful request can remove files outside the intended scope and may make the site unavailable.

ChatBot is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Chatbot is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Chatbot is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Chatbot is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.