CVE-2026-110886

CriticalCVSS 9.8

Published: 18/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Summary

The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.

Risk Assessment

This could lead to remote code execution or other severe impacts depending on the application context. Organizations using this plugin are at risk.

Recommendation

Update the Conversational Forms for ChatBot plugin to the latest version that fixes this vulnerability. If updating is not possible, consider disabling the plugin.

Other vulnerabilities in Conversational Forms for ChatBot

CVE-2026-95531High
The Conversational Forms for ChatBot plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. This allows injection of a malicious PHP object.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS