CVE-2026-83593

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services WordPress plugin (all versions through 8.7.3) fails to sanitize and escape the 'conversation' parameter, allowing unauthenticated attackers to store arbitrary web scripts in pages. Because the access-control nonce is published to every public-facing page via wp_localize_script, any unauthenticated visitor can obtain it and submit a malicious payload, which then executes in the browser of any user who accesses the injected page. A successful injection lets an attacker run JavaScript in victims' browsers on the affected site, enabling actions such as session hijacking, redirects, or further payload delivery, with a scope-changed impact (C:L/I:L) across users. Any WordPress site running WPBot at or below version 8.7.3 is affected. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is currently known.

What to do: Update WPBot to the latest patched release (any version after 8.7.3) as soon as it is available; the published nonce offers no real protection, so until you patch, deactivate the plugin or apply a WAF rule to strip scripts/HTML from the 'conversation' parameter. After patching, review chatbot-related pages for previously stored injected scripts and clear any suspicious content.