14
CVEs
2
Critical
5
High
0
KEV
1
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
5
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (18)
Wordpress Plugin
34
Wpbot
26
Wpbot Ai Chatbot For Live Support Lead Generation Ai Services
6
Chatbot
5
PHP
4
Simple Link Directory
4
Slider Hero
3
Conversational Forms For Chatbot
2
Simple Video Directory
2
Wpot
1
Wpbot Pro Wordpress Chatbot
1
Comment Link Remove And Other Comment Tools
1
Infographic Maker
1
Simple Business Directory Pro
1
Simple Link Directory Pro
1
Woowbot Pro Max
1
Slider Hero With Video Background Animation
1
Chatbot For Ecommerce 8211 Woowbot
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13731 | Stored cross-site scripting in the WPBot AI ChatBot for WordPress (all versions through 8.4.9) lets unauthenticated attackers persist arbitrary JavaScript through the 'conversation' parameter, which later executes when the injected page is viewed - most notably by an administrator opening the chat-session reports in wp-admin. Because the AJAX nonce that guards the save endpoint is publicly emitted on every frontend page via wp_localize_script, any anonymous visitor can obtain it, so there is effectively no barrier to injection. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk stems from ease of exploitation rather than confirmed in-the-wild abuse. | HIGH | 7.2 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-57710 | Arbitrary file upload in the WoowBot Pro Max WordPress plugin (quantumcloud) through version 14.1.7 allows an authenticated attacker to upload files of dangerous types, leading to remote code execution on the underlying WordPress host. The scope-change CVSS 9.9 reflects that a low-privileged account can pivot to full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Patchstack has confirmed and cataloged the flaw. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-57707 | SQL injection in QuantumCloud's Simple Business Directory Pro WordPress plugin (all versions through 15.9.4) allows remote attackers to inject crafted SQL into backend database queries, enabling extraction of sensitive data such as user credentials and stored directory records. Patchstack rates it critical (CVSS 9.3) with a network attack vector and no authentication indicated in the supplied vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high score and scope-change flag make it a priority for any site running this plugin. | CRITICAL | 9.3 | 0.4% | 46 |
No patch
|
| CVE-2026-83593 | Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-57362 | Reflected cross-site scripting in the QuantumCloud ChatBot WordPress plugin (versions 8.3.2 and earlier) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script runs in the security context of the WordPress site rather than the vulnerable component alone. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57682 | Cross-site scripting in the Simple Link Directory WordPress plugin (versions 15.0.5 and earlier, by QuantumCloud) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates no authentication is required but a user must be lured into triggering the payload, and the changed scope reflects script execution crossing into the browser security context. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57363 | Stored cross-site scripting in the QuantumCloud ChatBot WordPress plugin (versions through 8.3.7) lets an attacker persist malicious script that executes in another user's browser when the affected page is viewed. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates a network-reachable, unauthenticated injection point that requires a victim to load the poisoned content and crosses a privilege boundary into the rendering context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-57414 | Stored Cross-Site Scripting in QuantumCloud's WoowBot (ChatBot for eCommerce) WordPress plugin allows authenticated low-privileged users to inject persistent malicious scripts that execute in victims' browsers when stored content is rendered. Versions through 4.6.1 are affected, with a scope change confirmed by the CVSS vector (S:C), meaning attacker-controlled JavaScript runs in the context of other users - including administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-61981 | Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-15106 | Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|
| CVE-2026-16773 | Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|
| CVE-2026-16774 | Missing authorization in the WPBot WordPress plugin allows unauthenticated attackers to send arbitrary emails from the site's domain. Versions up to 8.5.9 are vulnerable via the wpcs_send_email() AJAX handler, which lacks nonce verification and capability checks. No active exploitation has been identified, but the flaw can be easily automated for spam or phishing campaigns. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|
| CVE-2026-17582 | Second-order SQL Injection in the Slider Hero with Video Background, Animation WordPress plugin (versions up to and including 9.1.7) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database. The vulnerability arises in the slide-duplication workflow: slide fields are safely parameterized on write, but re-read as raw strings and concatenated directly into an INSERT statement without any escaping when an administrator invokes the heroduplicateslider action. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. | MEDIUM | 4.9 | 0.3% | 25 |
No patch
|
| CVE-2026-15610 | Authorization bypass in the WPBot AI ChatBot plugin for WordPress (all versions ≤ 8.5.6) permits any subscriber-level authenticated user to invoke the plugin's RAG document re-embedding functionality without authorization, directly modifying the rag_documents database table and triggering calls to the site owner's paid AI APIs (OpenAI, Gemini, OpenRouter, or xAI). The root cause is a missing capability check in class-qcld-bot-rag.php, confirmed by Wordfence and traceable to specific code paths in qcld-wpwbot.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.3 Medium score reflects constrained direct security impact - though financial harm from API credit exhaustion represents the primary real-world risk. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|