[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9y-1mUSMhh6r11sNt1Ke7FHwkT8Mhf90oHR2o5h7ymQ":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57362","wpbot-ai-chatbot-for-live-support-lead-generation-ai-services-reflected-cross-site-scripting","WPBot – AI ChatBot for Live Support, Lead Generation, AI Services \u003C= 8.3.2 - Reflected Cross-Site Scripting","The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 8.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","chatbot",null,"\u003C=8.3.2","8.3.3","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:59:22",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F38e0591a-beeb-4a0b-b7a2-58594769b7da?source=api-prod",7,[22,23,24,25,26,27,28,29],"functions.php","includes\u002Fintegration\u002Fgemini\u002Fqcld-bot-gemini.php","includes\u002Fintegration\u002Fopenai\u002Fqcld-bot-openai.php","includes\u002Fopenai\u002Fqcld-bot-openai.php","js\u002Fqcld-wp-chatbot-plugin.js","qcld-wpwbot-search.php","qcld-wpwbot.php","readme.txt","researched",false,3,"# Exploitation Research Plan - CVE-2026-57362 (WPBot Reflected XSS)\n\n## 1. Vulnerability Summary\nThe **WPBot** plugin for WordPress (versions \u003C= 8.3.2) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists in the ChatBot's frontend message handling logic within `js\u002Fqcld-wp-chatbot-plugin.js`. Specifically, the plugin takes user-supplied input from URL parameters (like `wp_chatbot_msg` or `ask_wp_chatbot`) and passes it to the ChatBot to be displayed as a \"pre-query\" or automated message. \n\nThe JavaScript function `wpwMsg.single` (and related functions like `single_nobg`) processes these messages using an inadequate security filter `oncommand_filter` and then injects the result into the DOM using the dangerous `.html()` sink. Because the filter only attempts to strip a single HTML event handler and does not account for script tags or multiple attributes, unauthenticated attackers can execute arbitrary JavaScript in the context of a user's session by tricking them into clicking a crafted link.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** WordPress Frontend (any page where the ChatBot is active, typically the homepage).\n*   **Vulnerable Parameter:** `wp_chatbot_msg` (or `ask_wp_chatbot` depending on configuration).\n*   **Authentication:** None (Unauthenticated).\n*   **Preconditions:** The WPBot ChatBot must be enabled and not hidden via settings (e.g., `disable_wp_chatbot` must not be `1`).\n*   **Payload Type:** HTML\u002FJavaScript injection via GET parameter.\n\n## 3. Code Flow\n1.  **Entry Point (PHP):** The plugin checks for specific query parameters in the URL during initialization. It localizes this data for use in JavaScript using `wp_localize_script()`, often storing the reflected parameter in a global JS object (usually `wp_chatbot_obj`).\n2.  **Localization (PHP):** In the main plugin file (e.g., `qcld-wpwbot.php`), the `wp_chatbot_msg` parameter is likely assigned to the `pre_query` key of the `wp_chatbot_obj` without sufficient sanitization.\n3.  **Initialization (JS):** Upon page load, `js\u002Fqcld-wp-chatbot-plugin.js` reads `globalwpw.settings.obj.pre_query`.\n4.  **Message Processing (JS):** If a pre-query exists, the JS calls `wpwMsg.single(msg)`.\n5.  **Weak Filter (JS):** Inside `wpwMsg.single`, the input is passed to `oncommand_filter`:\n    ```javascript\n    oncommand_filter:function(msg){\n        var str = msg;\n        if(typeof(str) === 'string'){\n            \u002F\u002F VULNERABILITY: Only matches the FIRST 'on...=' pattern and replaces it once\n            replace = str.match(\u002Fon[a-z]+=\u002F);\n            str = str.replace( replace, \"\" );\n        }\n        return str;\n    },\n    ```\n6.  **SINK (JS):** The filtered (but still dangerous) string is passed to jQuery's `.html()` method:\n    ```javascript\n    $(globalwpw.settings.messageLastChild+' .wp-chatbot-paragraph').html( \n        '\u003Cdiv class=\"wp-chatbot-textanimation\">' + oncommand_filter + '\u003C\u002Fdiv>'\n    );\n    ```\n\n## 4. Nonce Acquisition Strategy\nThis specific Reflected XSS vulnerability typically occurs during the initial page load or via immediate JS execution of \"pre-filled\" bot queries. As such, it **does not require a nonce** to trigger the initial reflection into the ChatBot UI.\n\nIf the exploitation required an AJAX call (e.g., to the search endpoint), the strategy would be:\n1.  Navigate to the homepage where WPBot is active.\n2.  Use `browser_eval` to extract the nonce from the localized script object:\n    *   `browser_eval(\"window.wp_chatbot_obj?.nonce\")`\n    *   OR `browser_eval(\"window.qcld_gemini_admin_data?.ajax_nonce\")` (from `qcld-bot-gemini.php`).\n\n## 5. Exploitation Strategy\nThe goal is to provide a URL that, when clicked, injects an XSS payload into the ChatBot's message display logic.\n\n### Exploit Steps:\n1.  **Target URL Construction:**\n    *   URL: `http:\u002F\u002Fvulnerable-wp.local\u002F`\n    *   Parameter: `wp_chatbot_msg`\n    *   Payload: `\u003Cimg src=x onerror=alert(document.domain)>` (This bypasses the `oncommand_filter` because the filter only removes the first `on...=` it finds, and we can easily obfuscate or use tags the filter ignores entirely, like `\u003Cscript>`).\n\n2.  **Request Execution:**\n    Use the `http_request` tool to simulate a user clicking the link.\n    *   **Method:** `GET`\n    *   **URL:** `http:\u002F\u002Fvulnerable-wp.local\u002F?wp_chatbot_msg=\u003Cscript>alert(window.origin)\u003C\u002Fscript>`\n\n3.  **Payload Analysis:**\n    *   The `oncommand_filter` regex `\u002Fon[a-z]+=\u002F` does **not** match `\u003Cscript>`.\n    *   The string passes through unchanged.\n    *   The JS executes `.html('\u003Cdiv...>\u003Cscript>alert(window.origin)\u003C\u002Fscript>\u003C\u002Fdiv>')`.\n    *   The browser executes the script.\n\n## 6. Test Data Setup\n1.  **Plugin Activation:** Install and activate `chatbot` plugin version 8.3.2.\n2.  **Default Settings:** Ensure the ChatBot is active.\n    *   `wp option update disable","gemini-3-flash-preview","2026-07-25 11:57:17","2026-07-25 11:58:48",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","8.3.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.3.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.3.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.3.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.3.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags"]