CVE-2026-83593: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

CVE-2026-83593 is a stored cross-site scripting vulnerability in the WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin. The flaw exists in all versions up to and including 8.7.3 due to improper neutralization of input in the 'conversation' parameter. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The nonce check implemented is ineffective as it is exposed on all public-facing pages via wp_localize_script, providing no real access control to prevent exploitation.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting the affected pages, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality and integrity. The vulnerability does not impact availability. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until a fix is available, consider disabling or restricting access to the vulnerable functionality if possible. The nonce check currently in place does not provide effective protection against unauthenticated exploitation.