CVE-2026-83593

Name of the Vulnerable Software and Affected Versions WPBot – AI ChatBot for Live Support, Lead Generation, AI Services versions prior to 8.7.4

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the conversation parameter. Because the nonce used for validation is localized into every public-facing page via wp localize script, it fails to act as an effective access control barrier, allowing the injected scripts to execute when a user accesses the affected page.

Recommendations Update WPBot – AI ChatBot for Live Support, Lead Generation, AI Services to version 8.7.4 or later. Avoid using the conversation parameter until the plugin is updated.