20
CVEs
3
Critical
8
High
0
KEV
1
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
8
MEDIUM
9
LOW
0
Monthly CVE Trend
Affected Products (18)
Wordpress Plugin
34
Wpbot
26
Wpbot Ai Chatbot For Live Support Lead Generation Ai Services
6
Chatbot
5
PHP
4
Simple Link Directory
4
Slider Hero
3
Conversational Forms For Chatbot
2
Simple Video Directory
2
Wpot
1
Wpbot Pro Wordpress Chatbot
1
Comment Link Remove And Other Comment Tools
1
Infographic Maker
1
Simple Business Directory Pro
1
Simple Link Directory Pro
1
Woowbot Pro Max
1
Slider Hero With Video Background Animation
1
Chatbot For Ecommerce 8211 Woowbot
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13731 | Stored cross-site scripting in the WPBot AI ChatBot for WordPress (all versions through 8.4.9) lets unauthenticated attackers persist arbitrary JavaScript through the 'conversation' parameter, which later executes when the injected page is viewed - most notably by an administrator opening the chat-session reports in wp-admin. Because the AJAX nonce that guards the save endpoint is publicly emitted on every frontend page via wp_localize_script, any anonymous visitor can obtain it, so there is effectively no barrier to injection. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk stems from ease of exploitation rather than confirmed in-the-wild abuse. | HIGH | 7.2 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-57710 | Arbitrary file upload in the WoowBot Pro Max WordPress plugin (quantumcloud) through version 14.1.7 allows an authenticated attacker to upload files of dangerous types, leading to remote code execution on the underlying WordPress host. The scope-change CVSS 9.9 reflects that a low-privileged account can pivot to full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Patchstack has confirmed and cataloged the flaw. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-32499 | A blind SQL injection vulnerability exists in QuantumCloud ChatBot plugin affecting versions up to and including 7.7.9, allowing attackers to execute arbitrary SQL commands through improper neutralization of special elements in SQL queries. The vulnerability impacts all installations of the ChatBot plugin across the affected version range, potentially enabling unauthorized data extraction, manipulation, or deletion depending on database permissions. While no CVSS score or EPSS data is currently available, the blind SQL injection classification indicates a high-risk condition requiring immediate patching. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2026-57707 | SQL injection in QuantumCloud's Simple Business Directory Pro WordPress plugin (all versions through 15.9.4) allows remote attackers to inject crafted SQL into backend database queries, enabling extraction of sensitive data such as user credentials and stored directory records. Patchstack rates it critical (CVSS 9.3) with a network attack vector and no authentication indicated in the supplied vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high score and scope-change flag make it a priority for any site running this plugin. | CRITICAL | 9.3 | 0.4% | 46 |
No patch
|
| CVE-2025-60223 | Arbitrary file deletion in QuantumCloud WPBot Pro WordPress Chatbot plugin versions 13.6.5 and earlier allows authenticated subscriber-level users to delete arbitrary files on the WordPress host via a path traversal flaw. With no public exploit identified at time of analysis, the issue still carries elevated risk because exploitation requires only the lowest-privilege WordPress role, which is auto-grantable on sites that allow open registration. Deleting files such as wp-config.php can trigger the WordPress install routine and lead to full site takeover. | HIGH | 7.7 | 0.4% | 38 |
No patch
|
| CVE-2024-32729 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal.1.8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-83593 | Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites. | HIGH | 7.2 | 0.3% | 36 |
No patch
|
| CVE-2026-40788 | Broken access control in the QuantumCloud ChatBot plugin for WordPress (versions <= 7.9.7) allows authenticated low-privileged users (Subscriber role) to invoke restricted plugin functionality without proper authorization checks, leading to integrity tampering and availability disruption. Reported by Patchstack and tracked as EUVD-2026-36991, with no public exploit identified at time of analysis. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-57362 | Reflected cross-site scripting in the QuantumCloud ChatBot WordPress plugin (versions 8.3.2 and earlier) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script runs in the security context of the WordPress site rather than the vulnerable component alone. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57682 | Cross-site scripting in the Simple Link Directory WordPress plugin (versions 15.0.5 and earlier, by QuantumCloud) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates no authentication is required but a user must be lured into triggering the payload, and the changed scope reflects script execution crossing into the browser security context. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57363 | Stored cross-site scripting in the QuantumCloud ChatBot WordPress plugin (versions through 8.3.7) lets an attacker persist malicious script that executes in another user's browser when the affected page is viewed. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates a network-reachable, unauthenticated injection point that requires a victim to load the poisoned content and crosses a privilege boundary into the rendering context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | HIGH | 7.1 | 0.3% | 36 |
No patch
|
| CVE-2026-57414 | Stored Cross-Site Scripting in QuantumCloud's WoowBot (ChatBot for eCommerce) WordPress plugin allows authenticated low-privileged users to inject persistent malicious scripts that execute in victims' browsers when stored content is rendered. Versions through 4.6.1 are affected, with a scope change confirmed by the CVSS vector (S:C), meaning attacker-controlled JavaScript runs in the context of other users - including administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-61981 | Cross-Site Request Forgery in Simple Link Directory Pro WordPress plugin (≤15.0.8) enables a remote unauthenticated attacker to execute unauthorized state-changing actions on a victim's WordPress installation by tricking an authenticated administrator into clicking a crafted malicious link. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials of their own, but must socially engineer an authenticated administrator to trigger the forged request. No public exploit code or active exploitation has been identified at time of analysis, and CVSS impact signals are limited to low integrity and availability degradation with no confidentiality loss. | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-15106 | Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|
| CVE-2026-16773 | Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements. | MEDIUM | 5.3 | 0.3% | 26 |
No patch
|