Stored Cross-Site Scripting Vulnerability in WPBot Plugin for WordPress
CVE-2026-83593

7.2HIGH

Key Information:

Vendor

WordPress
Status
WPbot – Ai Chatbot For Live Support, Lead Generation, Ai Services
Vendor
CVE Published:
9 September 2026

What is CVE-2026-83593?

The WPBot plugin for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability through the 'conversation' parameter. This flaw arises from inadequate input sanitization and output escaping across all versions up to 8.7.3. As a result, unauthenticated attackers can inject malicious web scripts into web pages, which will execute when any user accesses the compromised page. The nonce, intended as a security measure, is included on every public-facing page but fails to act as an effective barrier against these types of attacks, leaving websites at risk.

Affected Version(s)

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services 0 <= 8.7.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/chatbot/tags/8...
https://plugins.trac.wordpress.org/browser/chatbot/tags/8...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivaylo
.