# WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services

> AI ChatBot & Automation for WordPress WPBot. 24/7 Live Chat Customer Support. NATIVE, AI Actions, Forms, Leads, Gemini, ChatGPT, Claude, OpenRouter ✨

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:30 UTC.

## Facts (WordPress.org)

- Slug: `chatbot`
- Author: QuantumCloud
- Version: 8.9.3
- Active installs: 5,000+
- Last update: 2026-11-10 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.2, PHP 7.4
- Tags: AI, chatbot, ChatGPT, live chat, live support
- Page: https://wordpress.org/plugins/chatbot/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Inaccessible ↔ Accessible, Paywalled ↔ Generous, Locked in ↔ Portable, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-09-16 MEDIUM: Missing Authorization (8.7.2 to 8.7.5). CVE-2026-87959, https://www.wordfence.com/threat-intel/vulnerabilities/id/17faa495-7758-49ec-8418-c5175f9615f2?source=api-prod
- 2026-09-12 MEDIUM: Unauthenticated Information Exposure (up to 8.5.9). CVE-2026-87916, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0467322-7fbc-40be-ad0f-23139de9d59e?source=api-prod
- 2026-09-12 MEDIUM: Missing Authorization (before 8.5.7). CVE-2026-87918, https://www.wordfence.com/threat-intel/vulnerabilities/id/226fa189-1ad7-467a-8274-b18e171f6448?source=api-prod
- 2026-09-09 HIGH: Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (up to 8.7.3). CVE-2026-83593, https://www.wordfence.com/threat-intel/vulnerabilities/id/710fb372-4b7e-43e3-86a7-417143536f43?source=api-prod
- 2026-07-28 MEDIUM: Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action (up to 8.5.9). CVE-2026-16773, https://www.wordfence.com/threat-intel/vulnerabilities/id/5463548c-22bd-4645-a94d-ee8c6a236337?source=api-prod
- 2026-07-28 MEDIUM: Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action (up to 8.5.9). CVE-2026-16774, https://www.wordfence.com/threat-intel/vulnerabilities/id/3cc6aa06-ab2a-4d5c-bbbe-4c19722ccc53?source=api-prod
- 2026-07-27 MEDIUM: Authenticated (Administrator+) SQL Injection (up to 8.5.1). CVE-2026-14189, https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4cf9eb-8f89-4cc7-9cdf-6d2e76f31388?source=api-prod
- 2026-07-21 MEDIUM: Missing Authorization (up to 8.1.0). CVE-2026-14185, https://www.wordfence.com/threat-intel/vulnerabilities/id/35a8ca49-6d23-43c1-a14a-0aa9f7214e73?source=api-prod
- 2026-07-16 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter (up to 8.5.6). CVE-2026-15106, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc36ee53-81a9-416e-8e74-31d9c8802d6c?source=api-prod
- 2026-07-16 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function (up to 8.5.6). CVE-2026-15610, https://www.wordfence.com/threat-intel/vulnerabilities/id/e905d146-66bf-4d6d-b2f5-fd3f862101af?source=api-prod
- 2026-07-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 8.3.7). CVE-2026-57363, https://www.wordfence.com/threat-intel/vulnerabilities/id/c65a4ac6-0438-40d0-b0b4-32366fac477c?source=api-prod
- 2026-07-02 MEDIUM: Reflected Cross-Site Scripting (up to 8.3.2). CVE-2026-57362, https://www.wordfence.com/threat-intel/vulnerabilities/id/38e0591a-beeb-4a0b-b7a2-58594769b7da?source=api-prod
- 2026-07-01 HIGH: Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (up to 8.4.9). CVE-2026-13731, https://www.wordfence.com/threat-intel/vulnerabilities/id/124f2b72-d8da-46ba-844f-e9cc01441702?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 7.9.7). CVE-2026-40788, https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f0556e-a875-4f88-b96c-a924f8fe01da?source=api-prod
- 2026-03-20 HIGH: Unauthenticated SQL Injection (up to 7.7.9). CVE-2026-32499, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb1a977f-e5ce-425b-8817-c03b2a660265?source=api-prod
- 2025-10-13 MEDIUM: Missing Authorization (up to 7.7.3). CVE-2025-62952, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc96bbc5-b4ad-4076-a0dd-13e3407b9d76?source=api-prod
- 2025-10-12 MEDIUM: Missing Authorization (up to 7.3.9). CVE-2025-64277, https://www.wordfence.com/threat-intel/vulnerabilities/id/3c18d155-9c9d-4ffa-8faa-09bb67406266?source=api-prod
- 2025-08-19 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 7.0.0). CVE-2025-9111, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2136a08-93be-4611-9eff-6a9258401b96?source=api-prod
- 2025-06-27 MEDIUM: Missing Authorization (up to 6.7.3). CVE-2025-53200, https://www.wordfence.com/threat-intel/vulnerabilities/id/83dfd6a2-2944-42a9-9e3d-60836ebfb106?source=api-prod
- 2025-03-03 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 6.2.3). CVE-2025-0329, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9a40e6-2b63-4866-9eec-ff09e73dc8fb?source=api-prod
- 2025-02-23 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 6.3.5). CVE-2025-26932, https://www.wordfence.com/threat-intel/vulnerabilities/id/5c8409c8-8917-4343-a6e6-c6b6be04a236?source=api-prod
- 2024-07-16 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 5.5.7). CVE-2024-6669, https://www.wordfence.com/threat-intel/vulnerabilities/id/ce23efed-fe21-486a-ab3b-9ed0dd26a971?source=api-prod
- 2024-05-21 MEDIUM: Missing Authorization via openai_file_list_callback (up to 5.3.4). CVE-2024-0451, https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0572a5-6cc9-43ab-a4a3-c8d3b93c8fcf?source=api-prod
- 2024-05-21 MEDIUM: Missing Authorization via openai_file_upload_callback (up to 5.3.4). CVE-2024-0452, https://www.wordfence.com/threat-intel/vulnerabilities/id/34b6475c-b5dd-42a1-98d1-9b5ae9ff4ad5?source=api-prod
- 2024-05-21 MEDIUM: Missing Authorization via openai_file_delete_callback (up to 5.3.4). CVE-2024-0453, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0ef4a5-42d7-4cea-b19f-51917e3ee55f?source=api-prod
- 2024-01-19 CRITICAL: Unauthenticated PHP Object Injection (up to 5.1.0). CVE-2024-22309, https://www.wordfence.com/threat-intel/vulnerabilities/id/75432cfd-7c0d-4d93-9b62-cac0fd9b49d5?source=api-prod
- 2023-11-23 HIGH: Authenticated (Administrator+) SQL Injection (up to 4.7.8). CVE-2023-48741, https://www.wordfence.com/threat-intel/vulnerabilities/id/db1bb11d-4752-42d0-b538-2d2a4c827226?source=api-prod
- 2023-11-01 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder (4.8.6 to 4.9.6). CVE-2023-5606, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc305c48-8337-42b7-ad61-61aea8018def?source=api-prod
- 2023-10-11 CRITICAL: Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file (up to 4.8.9, 4.9.2 to 4.9.2). CVE-2023-5241, https://www.wordfence.com/threat-intel/vulnerabilities/id/25199281-5286-4d75-8d27-26ce215e0993?source=api-prod
- 2023-10-11 CRITICAL: Unauthenticated SQL Injection via qc_wpbo_search_response (up to 4.8.9). CVE-2023-5204, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad12146-200b-48e5-82de-7572541edcc4?source=api-prod
- 2023-10-11 CRITICAL: AI ChatBot <= 4.8.9  and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file (up to 4.8.9, 4.9.2 to 4.9.2). CVE-2023-5212, https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3f4ccb-fcc6-42ec-8e9e-03d69ae7acf2?source=api-prod
- 2023-10-11 MEDIUM: Cross-Site Request Forgery on AJAX actions (up to 4.8.9, 4.9.2 to 4.9.2). CVE-2023-5534, https://www.wordfence.com/threat-intel/vulnerabilities/id/846bd929-45cd-4e91-b232-ae16dd2b12a0?source=api-prod
- 2023-10-11 MEDIUM: Missing Authorization on AJAX actions (up to 4.8.9, 4.9.2 to 4.9.2). CVE-2023-5533, https://www.wordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=api-prod
- 2023-10-11 MEDIUM: Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user (up to 4.8.9). CVE-2023-5254, https://www.wordfence.com/threat-intel/vulnerabilities/id/d897daf8-5320-4546-9a63-1d34a15b2a58?source=api-prod
- 2023-10-03 MEDIUM: Cross-Site Request Forgery via qc_wp_latest_update_check (up to 4.7.8). CVE-2023-44993, https://www.wordfence.com/threat-intel/vulnerabilities/id/be9522c8-3561-48fe-89ef-62e0fcb085b0?source=api-prod
- 2023-08-08 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings (up to 4.7.7). CVE-2023-4254, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f5f8bd5-435a-4a53-8fa2-55674f39b78b?source=api-prod
- 2023-08-08 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder (up to 4.7.7). CVE-2023-4253, https://www.wordfence.com/threat-intel/vulnerabilities/id/1cc50245-365a-419d-a85c-fbd658d004ae?source=api-prod
- 2023-05-25 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.5.5). CVE-2023-2811, https://www.wordfence.com/threat-intel/vulnerabilities/id/9df97805-b425-49b1-86c1-e66213dacd2b?source=api-prod
- 2023-05-22 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.6.0). CVE-2023-3175, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed1c2a2-54ee-4dc8-a54d-01d7a6dbc22e?source=api-prod
- 2023-05-22 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.5.4). CVE-2023-2742, https://www.wordfence.com/threat-intel/vulnerabilities/id/c40752df-1337-475b-8b5e-0d171946bfe9?source=api-prod
- 2023-04-20 MEDIUM: Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery (up to 4.4.4). CVE-2023-1011, https://www.wordfence.com/threat-intel/vulnerabilities/id/56fad8de-6646-4305-83a9-0ed443c3aa7d?source=api-prod
- 2023-04-12 CRITICAL: Unauthenticated PHP Object Injection via Cookies (up to 4.4.6). CVE-2023-1650, https://www.wordfence.com/threat-intel/vulnerabilities/id/364fe5b3-561e-4005-a589-c7c2b9e85b99?source=api-prod
- 2023-04-12 MEDIUM: Unauthenticated Stored Cross-Site Scripting in Admin Dashboard (up to 4.4.8). CVE-2023-1660, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4feb8e8-8620-44b9-9e8d-7ea513e168ff?source=api-prod
- 2023-04-12 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 4.4.9). CVE-2023-1649, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb3fbaa-4d33-4754-848b-77e902ea4a85?source=api-prod
- 2023-04-12 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback (up to 4.4.8). CVE-2023-1651, https://www.wordfence.com/threat-intel/vulnerabilities/id/d69cfed9-7369-40f3-b9a7-0cf2430e8eed?source=api-prod
- 2023-03-29 MEDIUM: Missing Authorization on openai_settings_option_callback (up to 4.4.7). WF-b33bf55c-0397-44a2-8c18-ea5f8f1e2ec9, https://www.wordfence.com/threat-intel/vulnerabilities/id/b33bf55c-0397-44a2-8c18-ea5f8f1e2ec9?source=api-prod
- 2023-01-27 MEDIUM: Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset (up to 4.2.8). CVE-2023-24415, https://www.wordfence.com/threat-intel/vulnerabilities/id/04a79a78-a6d3-40ef-9b26-8e2e00534b7a?source=api-prod
- 2023-01-27 MEDIUM: Authenticated (Admin+) Cross-Site Scripting (up to 4.3.0). CVE-2022-47613, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed8f004-f68d-40fb-bca1-b0b92cf24fdb?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=chatbot · HTML: https://todaywp.com/plugins/chatbot