WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

This research plan outlines the technical steps for an automated security agent to verify a Stored Cross-Site Scripting (XSS) vulnerability in the WPBot plugin (CVE-2026-13731).

1. Vulnerability Summary

The WPBot plugin (<= 8.4.9) fails to sanitize and escape the conversation parameter during an unauthenticated AJAX "save" request. This allows an attacker to store arbitrary JavaScript in the database. Because the AJAX nonce is localized to the obj JavaScript object on all frontend pages, any visitor can retrieve the credentials necessary to perform the injection. The payload executes when an administrator views the conversation logs or when the injected content is rendered back to users.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: qcld_wb_chatbot_conversation_save (Inferred from plugin naming conventions and description).
• Vulnerable Parameter: conversation
• Authentication: Unauthenticated (via wp_ajax_nopriv_ hook).
• Preconditions: The chatbot must be enabled (default state) to ensure the script and nonce are localized on the frontend.

3. Code Flow

1. Nonce Generation: In qcld-wpwbot.php (around line 271), the plugin calls wp_localize_script for the handle qcld-wp-chatbot-front-js, exposing a configuration object named obj.
2. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with action=qcld_wb_chatbot_conversation_save.
3. Processing (Inferred): The handler function (e.g., qcld_wb_chatbot_conversation_save_callback) retrieves the conversation parameter from $_POST.
4. Sink: The raw input is saved into a custom table (e.g., wp_qcld_wb_chatbot_conversation) or the options table without using sanitize_text_field or wp_kses.
5. Execution: An administrator navigates to the "WPBot" -> "Chat History" (or similar) menu, where the saved conversation is printed directly to the HTML without esc_html.

4. Nonce Acquisition Strategy

The nonce is required for the AJAX request. It is stored in a global JavaScript object.

1. Navigate to the homepage: The chatbot UI loads on most public-facing pages.
2. Identify the Variable: Based on qcld-wpwbot.php, the localization object is obj.
3. Extract the Nonce: Use the browser_eval tool to retrieve the nonce value.
   • Command: browser_eval("window.obj?.nonce")
   • Alternative Key: If nonce is undefined, check window.obj?.ajax_nonce (Inferred).

5. Exploitation Strategy

1. Preparation: Navigate to the WordPress homepage to ensure the chatbot scripts are loaded and the obj variable is available.
2. Retrieve Nonce: Execute browser_eval("window.obj.nonce") to capture the nonce.
3. Injection Request: Use http_request to send the payload.
   • Method: POST
   • URL: http://[TARGET]/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=qcld_wb_chatbot_conversation_save&nonce=[RETRIEVED_NONCE]&conversation=<script>alert("XSS_STORED_SUCCESS")</script>
     

4. Trigger: Log in as an administrator and visit the ChatBot control panel (found in admin_ui.php under the wpbot-panel slug) to view the history.

6. Test Data Setup

1. Plugin Activation: Ensure the chatbot plugin is active.
2. Configuration: No special configuration is required as the default settings typically enable the chatbot on the frontend.
3. Target Page: Ensure at least one page exists (like the default "Sample Page") where the chatbot button is visible.

7. Expected Results

• The AJAX request should return a 200 OK or a success JSON message (e.g., {"success":true}).
• When an admin views the conversation log, a browser alert with "XSS_STORED_SUCCESS" should trigger.
• The HTML source of the admin page should contain the raw <script> tag.

8. Verification Steps

1. DB Check: Use WP-CLI to inspect the stored data:
   • wp db query "SELECT * FROM wp_qcld_wb_chatbot_conversation ORDER BY id DESC LIMIT 1;" (Verify table name; if not present, check wp_options for conversation-related keys).
2. UI Check: Use browser_navigate as an admin to the WPBot history page and check for the existence of the script in the DOM.

9. Alternative Approaches

• Parameter Variation: If conversation does not trigger the storage, check for msg, message, or chat parameters (Inferred).
• Session-Based XSS: Some versions of WPBot store the conversation in the user's session/cookie before saving; if the AJAX request fails, check if the payload can be injected via the client_msg parameter in other bot-interaction actions.