CVE-2026-57362
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The ChatBot plugin version 8.3.2 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves the execution of arbitrary JavaScript code in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
It is recommended to immediately update the ChatBot plugin to the latest available version that fixes this vulnerability. Consider also deploying a Web Application Firewall (WAF) to block XSS attacks.
Other vulnerabilities in ChatBot
See all- CVE-2026-16774Medium
The Chatbot plugin for WordPress up to version 8.5.9 is vulnerable to Missing Authorization in the wpcs_send_email() AJAX handler. The function is registered for both authenticated and unauthenticated users without nonce verification, capability check, or rate limiting, and forwards attacker-controlled recipient, subject, and body directly to wp_mail(). This allows unauthenticated attackers to send arbitrary emails from the site's domain.
- CVE-2026-57363High
The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.
- CVE-2026-40788High
ChatBot versions up to 7.9.7 have a vulnerability in access control that may allow unauthorized subscribers to access resources.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.