Advisories · Technology
quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services.
Every CVE that names quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Information disclosure
- CVSS 5.3 Medium
WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 4.3 Medium
WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 5.3 Medium
WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 7.2 High
WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 5.0 Medium
AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 5.0 Medium
AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 5.3 Medium
AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Broken access control
- CVSS 4.3 Medium
AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Information disclosure
- CVSS 9.6 CriticalCritical · CVSS 9+
AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- SQL injection
- CVSS 9.6 CriticalCritical · CVSS 9+
AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Path traversal