CVE-2026-13731

Name of the Vulnerable Software and Affected Versions WPBot – AI ChatBot for Live Support, Lead Generation, AI Services versions prior to 8.5.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the conversation parameter. Because the AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp localize script, anonymous visitors can easily obtain it to inject arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update to a version newer than 8.4.9.