Stored Cross-Site Scripting in WPBot WordPress Plugin

The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-83593. The vulnerability exists in the 'conversation' parameter and affects all versions up to and including 8.7.3. It stems from insufficient input sanitization and output escaping.

Defenders should note that the plugin's nonce check, intended to act as an access control mechanism, is rendered ineffective because it is localized into public-facing pages via the 'wp_localize_script' function. This allows unauthenticated attackers to bypass the check and inject malicious payloads into the conversation flow. Once stored, these scripts execute within the browser context of any user, including administrators, who views the compromised page. This vulnerability poses a significant risk to WordPress sites utilizing this plugin for customer support, as it can lead to session hijacking, unauthorized actions, or credential theft.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary JavaScript in the victim's browser session. If an administrator views the compromised page, the attacker could potentially take full control of the WordPress site. The plugin is widely used for lead generation and customer support, making this a high-impact vector for sites relying on interactive chatbot functionality.

Recommendation

• Update the WPBot plugin to the latest available version (beyond 8.7.3) as soon as the vendor releases a patch.
• In the absence of a patch, disable the WPBot plugin on public-facing sites.
• Review access logs for POST requests containing JavaScript-like patterns in the 'conversation' parameter.