What is the CVSS score of CVE-2026-57363?

CVE-2026-57363 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of QuantumCloud ChatBot are affected by CVE-2026-57363?

The QuantumCloud ChatBot WordPress plugin (versions through 8.3.7) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject persistent malicious code into…

How to fix or mitigate CVE-2026-57363?

Within 24 hours, audit all WordPress installations to identify which versions of QuantumCloud ChatBot plugin (8.3.7 and earlier) are deployed and assess which instances host sensitive or user-facing content. Within 7 days, deploy Web Application Firewall rules to detect and block XSS payloads, enforce restrictive Content Security Policy (CSP) headers to prevent script execution in the browser rendering context, apply input validation and sanitization to all user-supplied content processed by the plugin, and establish restricted access so only trusted administrators can modify plugin-associated content. Contact the vendor immediately to obtain security update timeline. Within 30 days, evaluate long-term remediation options including disabling the plugin, migrating to alternative solutions, or upgrading if the vendor releases a patched version; establish ongoing monitoring for exploitation indicators and unauthorized modifications.

QuantumCloud ChatBot CVE-2026-57363

EUVD-2026-43446 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Chatbot Wordpress Plugin Quantumcloud

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable stored XSS injectable without authentication (PR:N) but firing only on victim page-load (UI:R), crossing into the browser context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:08 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.

AnalysisAI

Stored cross-site scripting in the QuantumCloud ChatBot WordPress plugin (versions through 8.3.7) lets an attacker persist malicious script that executes in another user's browser when the affected page is viewed. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates a network-reachable, unauthenticated injection point that requires a victim to load the poisoned content and crosses a privilege boundary into the rendering context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The plugin is a WordPress chatbot component (CPE cpe:2.3:a:quantumcloud:chatbot) that accepts and later renders user-supplied conversational or configuration input inside generated web pages. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: input is stored server-side and echoed back into HTML without adequate output encoding or sanitization, so an HTML/script payload is interpreted by the browser rather than displayed as text. Because it is stored (persistent) rather than reflected, the payload survives across sessions and fires for every user who subsequently loads the affected view, which aligns with the Scope:Changed metric in the CVSS vector.

RemediationAI

Upgrade the QuantumCloud ChatBot plugin to the first release published after 8.3.7 once the vendor makes it available; no vendor-released patched version is independently confirmed in the provided data, so monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-chatbot-plugin-8-3-7-cross-site-scripting-xss-vulnerability) and the WordPress plugin changelog for the fixed build. Until a patch is confirmed, consider deploying a WAF or Patchstack virtual patch to filter script payloads in chatbot input, restrict who can submit or configure chatbot content, and add a Content-Security-Policy that blocks inline script execution to blunt payload firing - noting that a strict CSP can break legitimate inline widgets and a WAF rule may cause false positives on chat messages containing markup. If the plugin is non-essential, deactivating it removes the exposure entirely at the cost of the chatbot feature.