The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator-level permissions can inject malicious scripts via the plugin's admin settings. These scripts execute whenever a user accesses the affected pages. The vulnerability affects all versions up to 5.5.7 and is limited to multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 5.5, indicating medium severity with network attack vector, low attack complexity, and high privileges required.

An attacker with administrator-level access can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by users. The vulnerability does not affect availability. The impact is constrained by the requirement for high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). No known exploitation in the wild has been reported.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict administrator access to trusted personnel only and consider disabling or limiting the use of the WPBot plugin in multi-site environments or where unfiltered_html is disabled. Review and sanitize any input in admin settings manually if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.