CVE-2026-13731 Scanner

WPBot is a chatbot plugin widely used to enhance user interaction on WordPress websites. It is developed by QuantumCloud and allows businesses to automate customer support, streamline communication, and improve engagement through automated conversation. The tool is highly regarded for its ease of integration and customization options, making it a popular choice among site administrators seeking to provide users with a seamless chat experience. WPBot operates as an add-on to WordPress, allowing site owners to deploy quick support messages across various platforms. The plugin's versatility makes it a sought-after solution for enhancing digital communication, applicable to various industries, from e-commerce to educational sites. However, maintaining its robust functionality requires regular updates to counter vulnerabilities such as the Cross-Site Scripting flaw.

The vulnerability detected in WPBot involves a stored Cross-Site Scripting (XSS) flaw, which is prevalent in versions up to 8.4.9. This type of vulnerability allows attackers to inject malicious scripts into web applications. Unauthenticated attackers specifically exploit the conversation parameter in the AJAX action, leveraging publicly available nonces to execute scripts upon administrator session views. The lack of input sanitization allows harmful scripts to be entered and stored in the site's database, presenting a significant security risk. When an administrator accesses the chat session views, these scripts can execute unwanted actions, leading to potential site compromise.

Technical details about this vulnerability include its exploitation through the WPBot's AJAX action used for saving conversations. Attackers can inject scripts via the conversation parameter and obtain the nonce value emitted publicly under the ajax_nonce key without authentication barriers. These scripts are inadequately sanitized when entered and rendered without filtering in the admin chat session views. Users are vulnerable since the process allows arbitrary JavaScript execution, resulting in possible session hijacking and credential theft when administrative pages are accessed.

Possible effects of exploiting this vulnerability include unauthorized JavaScript injection within admin chat sessions, potentially leading to session hijacking or theft of admin credentials. Malicious users can further compromise the site by executing arbitrary scripts, resulting in broader access to sensitive database content. Successful exploitation can degrade the integrity of site security and result in the exfiltration of confidential information. The incident can cause reputational damage to organizations relying on WPBot for seamless client interaction.

REFERENCES

• https://www.wordfence.com/threat-intel/vulnerabilities/id/124f2b72-d8da-46ba-844f-e9cc01441702
• https://plugins.trac.wordpress.org/browser/chatbot/tags/8.4.9/includes/chat-sessions/wpbot-chat-sessions.php#L509