CVE-2026-13731 is a stored Cross-Site Scripting vulnerability in the WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin. The issue exists in all versions up to and including 8.4.9 due to improper neutralization of input in the 'conversation' parameter. Attackers can inject malicious scripts that execute when users access the affected pages. The AJAX nonce, which normally protects against unauthorized requests, is publicly available on every frontend page via wp_localize_script, removing practical barriers to exploitation by unauthenticated attackers.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 7.2 (high severity), reflecting its network attack vector, low complexity, no privileges required, no user interaction needed, and impact on confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to mitigate risk. Monitoring vendor channels for updates or patches is recommended.