What is the CVSS score of CVE-2026-57414?

CVE-2026-57414 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

WoowBot CVE-2026-57414

EUVD-2026-43486 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Chatbot For Ecommerce 8211 Woowbot Quantumcloud

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS via authenticated chatbot input; PR:L required for payload submission, UI:R for victim trigger, S:C for cross-user browser impact; A:N as XSS does not cause meaningful availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:24 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce – WoowBot: from n/a through <= 4.6.1.

AnalysisAI

Stored Cross-Site Scripting in QuantumCloud's WoowBot (ChatBot for eCommerce) WordPress plugin allows authenticated low-privileged users to inject persistent malicious scripts that execute in victims' browsers when stored content is rendered. Versions through 4.6.1 are affected, with a scope change confirmed by the CVSS vector (S:C), meaning attacker-controlled JavaScript runs in the context of other users - including administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

WoowBot is a WooCommerce-integrated chatbot plugin for WordPress (CPE: cpe:2.3:a:quantumcloud:chatbot_for_ecommerce_-_woowbot:*:*:*:*:*:*:*:*). The root cause is CWE-79 - Improper Neutralization of Input During Web Page Generation - specifically in its Stored XSS variant, where user-supplied input is persisted to the database without adequate sanitization or output encoding, and later rendered into HTML page responses. This is a classic server-side storage flaw: the malicious payload survives across sessions and executes for every subsequent user who views the affected page, unlike Reflected XSS which requires per-request delivery. WordPress plugins are a frequent vector for this class of vulnerability due to inconsistent use of WordPress core escaping functions such as esc_html() and wp_kses_post().

RemediationAI

The primary remediation is to update the WoowBot plugin beyond version 4.6.1; however, an exact patched release version is not confirmed in the available intelligence - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woowbot-woocommerce-chatbot/vulnerability/wordpress-chatbot-for-ecommerce-woowbot-plugin-4-6-1-cross-site-scripting-xss-vulnerability and the WordPress plugin repository for the latest release. If an immediate update is not possible, a compensating control is to restrict chatbot submission access to only authenticated users with trusted roles (e.g., remove open customer registration or gate chatbot use behind role checks), reducing the PR:L attack surface to already-vetted accounts. A Web Application Firewall rule filtering script injection patterns in chatbot input fields can reduce exploitation likelihood but is not a substitute for patching, as WAF bypass techniques for XSS payloads are well-documented. Site administrators should also review stored chatbot conversation logs for anomalous script tags as an indicator of prior exploitation attempts.