Ivaylo

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp localize script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.

**Name of the Vulnerable Software and Affected Versions** Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `action` parameter in the `admin-ajax.php` endpoint. An attacker can inject arbitrary web scripts by sending a request where the `action` value matches an entry in the plugin's explicit-actions list, which is auto-populated for common form builders during activation and lacks authentication requirements to reach the save path. These scripts execute whenever a user accesses the affected page. **Recommendations** Update to a version newer than 5.1.