Logo
Retour à la veille

CVE-2026-83593

Publié : 9 septembre 2026
Modifié : 9 septembre 2026
Lien officiel NVD
Score CVSS
7.2
HIGH

Description détaillée

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/functions.php#L1922https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/js/admin.js#L86https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L564https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L566https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L708https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/includes/chat-sessions/wpbot-chat-sessions.php#L866https://plugins.trac.wordpress.org/browser/chatbot/tags/8.5.6/qcld-wpwbot.php#L613https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/functions.php#L1922https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/js/admin.js#L86https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L564https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L566https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L708https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/includes/chat-sessions/wpbot-chat-sessions.php#L866https://plugins.trac.wordpress.org/browser/chatbot/tags/8.6.9/qcld-wpwbot.php#L613https://plugins.trac.wordpress.org/changeset?reponame=&old=3679725%40chatbot&new=3679725%40chatbothttps://www.wordfence.com/threat-intel/vulnerabilities/id/710fb372-4b7e-43e3-86a7-417143536f43?source=cve

Dernières Vulnérabilités

CVE-2026-80177

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to script injection.

VOIR DÉTAILS

CVE-2026-80124

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

VOIR DÉTAILS

CVE-2026-80123

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

VOIR DÉTAILS