[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvktjAuLDg8bGmR2FL5Owm7_Iur-255hGNNvPZjsCUcI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13731","wpbot-unauthenticated-stored-cross-site-scripting-via-conversation-parameter","WPBot \u003C= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter","The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.","chatbot",null,"\u003C=8.4.9","8.5.0","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-06-30 15:06:02","2026-07-01 03:43:34",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F124f2b72-d8da-46ba-844f-e9cc01441702?source=api-prod",1,[22,23,24,25,26,27,28,29],".idea\u002Fmodules.xml",".idea\u002Fwoowbot-woocommerce-chatbot-pro.iml",".idea\u002Fworkspace.xml","admin_ui.php","class-plugin-deactivate-feedback.php","class-qc-free-plugin-upgrade-notice.php","functions.php","images\u002Fcheck2.svg","researched",false,3,"This research plan outlines the technical steps for an automated security agent to verify a Stored Cross-Site Scripting (XSS) vulnerability in the WPBot plugin (CVE-2026-13731).\n\n## 1. Vulnerability Summary\nThe WPBot plugin (\u003C= 8.4.9) fails to sanitize and escape the `conversation` parameter during an unauthenticated AJAX \"save\" request. This allows an attacker to store arbitrary JavaScript in the database. Because the AJAX nonce is localized to the `obj` JavaScript object on all frontend pages, any visitor can retrieve the credentials necessary to perform the injection. The payload executes when an administrator views the conversation logs or when the injected content is rendered back to users.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action:** `qcld_wb_chatbot_conversation_save` (Inferred from plugin naming conventions and description).\n- **Vulnerable Parameter:** `conversation`\n- **Authentication:** Unauthenticated (via `wp_ajax_nopriv_` hook).\n- **Preconditions:** The chatbot must be enabled (default state) to ensure the script and nonce are localized on the frontend.\n\n## 3. Code Flow\n1. **Nonce Generation:** In `qcld-wpwbot.php` (around line 271), the plugin calls `wp_localize_script` for the handle `qcld-wp-chatbot-front-js`, exposing a configuration object named `obj`.\n2. **Entry Point:** An unauthenticated user sends a POST request to `admin-ajax.php` with `action=qcld_wb_chatbot_conversation_save`.\n3. **Processing (Inferred):** The handler function (e.g., `qcld_wb_chatbot_conversation_save_callback`) retrieves the `conversation` parameter from `$_POST`.\n4. **Sink:** The raw input is saved into a custom table (e.g., `wp_qcld_wb_chatbot_conversation`) or the options table without using `sanitize_text_field` or `wp_kses`.\n5. **Execution:** An administrator navigates to the \"WPBot\" -> \"Chat History\" (or similar) menu, where the saved conversation is printed directly to the HTML without `esc_html`.\n\n## 4. Nonce Acquisition Strategy\nThe nonce is required for the AJAX request. It is stored in a global JavaScript object.\n\n1. **Navigate to the homepage:** The chatbot UI loads on most public-facing pages.\n2. **Identify the Variable:** Based on `qcld-wpwbot.php`, the localization object is `obj`.\n3. **Extract the Nonce:** Use the `browser_eval` tool to retrieve the nonce value.\n   - **Command:** `browser_eval(\"window.obj?.nonce\")`\n   - **Alternative Key:** If `nonce` is undefined, check `window.obj?.ajax_nonce` (Inferred).\n\n## 5. Exploitation Strategy\n1. **Preparation:** Navigate to the WordPress homepage to ensure the chatbot scripts are loaded and the `obj` variable is available.\n2. **Retrieve Nonce:** Execute `browser_eval(\"window.obj.nonce\")` to capture the nonce.\n3. **Injection Request:** Use `http_request` to send the payload.\n   - **Method:** `POST`\n   - **URL:** `http:\u002F\u002F[TARGET]\u002Fwp-admin\u002Fadmin-ajax.php`\n   - **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n   - **Body:**\n     ```\n     action=qcld_wb_chatbot_conversation_save&nonce=[RETRIEVED_NONCE]&conversation=\u003Cscript>alert(\"XSS_STORED_SUCCESS\")\u003C\u002Fscript>\n     ```\n4. **Trigger:** Log in as an administrator and visit the ChatBot control panel (found in `admin_ui.php` under the `wpbot-panel` slug) to view the history.\n\n## 6. Test Data Setup\n1. **Plugin Activation:** Ensure the `chatbot` plugin is active.\n2. **Configuration:** No special configuration is required as the default settings typically enable the chatbot on the frontend.\n3. **Target Page:** Ensure at least one page exists (like the default \"Sample Page\") where the chatbot button is visible.\n\n## 7. Expected Results\n- The AJAX request should return a `200 OK` or a success JSON message (e.g., `{\"success\":true}`).\n- When an admin views the conversation log, a browser alert with \"XSS_STORED_SUCCESS\" should trigger.\n- The HTML source of the admin page should contain the raw `\u003Cscript>` tag.\n\n## 8. Verification Steps\n1. **DB Check:** Use WP-CLI to inspect the stored data:\n   - `wp db query \"SELECT * FROM wp_qcld_wb_chatbot_conversation ORDER BY id DESC LIMIT 1;\"` (Verify table name; if not present, check `wp_options` for conversation-related keys).\n2. **UI Check:** Use `browser_navigate` as an admin to the WPBot history page and check for the existence of the script in the DOM.\n\n## 9. Alternative Approaches\n- **Parameter Variation:** If `conversation` does not trigger the storage, check for `msg`, `message`, or `chat` parameters (Inferred).\n- **Session-Based XSS:** Some versions of WPBot store the conversation in the user's session\u002Fcookie before saving; if the AJAX request fails, check if the payload can be injected via the `client_msg` parameter in other bot-interaction actions.","The WPBot plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via the 'conversation' parameter in the 'qcld_wb_chatbot_conversation_save' AJAX action. Due to missing input sanitization and output escaping, unauthenticated attackers can inject arbitrary JavaScript that executes in the context of an administrator viewing chat history.","\u002F\u002F File: qcld-wpwbot.php (around line 271)\nwp_localize_script('qcld-wp-chatbot-front-js', 'obj', array(\n    'ajax_url' => admin_url('admin-ajax.php'),\n    'nonce' => wp_create_nonce('wp_chatbot'),\n));\n\n---\n\n\u002F\u002F Inferred AJAX handler for conversation saving in functions.php or qcld-wpwbot.php\nfunction qcld_wb_chatbot_conversation_save_callback() {\n    check_ajax_referer('wp_chatbot', 'nonce');\n    \n    \u002F\u002F Vulnerability: 'conversation' is taken directly from POST and saved to DB\n    $conversation = $_POST['conversation'];\n    \u002F\u002F ... database insert logic ...\n}\n\n---\n\n\u002F\u002F Inferred admin display logic in Chat History section\nforeach ($conversations as $chat) {\n    \u002F\u002F Vulnerability: The stored conversation is echoed without escaping\n    echo '\u003Ctd>' . $chat->conversation . '\u003C\u002Ftd>';\n}","--- a\u002Fqcld-wpwbot.php\n+++ b\u002Fqcld-wpwbot.php\n@@ -1050,7 +1050,7 @@\n function qcld_wb_chatbot_conversation_save_callback() {\n     check_ajax_referer('wp_chatbot', 'nonce');\n \n-    $conversation = $_POST['conversation'];\n+    $conversation = sanitize_textarea_field($_POST['conversation']);\n \n     \u002F\u002F ... database insert logic ...\n }\n--- a\u002Fadmin_ui.php\n+++ b\u002Fadmin_ui.php\n@@ -1200,7 +1200,7 @@\n foreach ($conversations as $chat) {\n-    echo '\u003Ctd>' . $chat->conversation . '\u003C\u002Ftd>';\n+    echo '\u003Ctd>' . wp_kses_post($chat->conversation) . '\u003C\u002Ftd>';\n }","1. Access any public page where the WPBot chatbot is active and extract the AJAX nonce from the localized 'obj' JavaScript object (found at window.obj.nonce).\n2. Construct a POST request to \u002Fwp-admin\u002Fadmin-ajax.php with the parameters: action=qcld_wb_chatbot_conversation_save, nonce=[RETRIEVED_NONCE], and conversation=[XSS_PAYLOAD].\n3. The XSS payload (e.g., \u003Cscript>alert(document.cookie)\u003C\u002Fscript>) will be stored in the database associated with chat logs.\n4. An administrator triggers the exploit by logging into the WordPress dashboard and visiting the WPBot 'Chat History' or log interface, which renders the unsanitized script in their browser.","gemini-3-flash-preview","2026-07-25 13:05:39","2026-07-25 13:06:30",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","8.4.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.4.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.4.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags\u002F8.5.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fchatbot.8.5.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fchatbot\u002Ftags"]