Veille CVE

Recherche « Unknown WPBot »

5 CVE

Critique 0 Élevée 0 Moyenne 4 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WPBot » ✕
  1. CVE-2026-87959 5.4 Moyenne

    Unknown WPBot

    The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.

  2. CVE-2026-87918 5.3 Moyenne

    Unknown WPBot

    The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

  3. CVE-2026-87916 5.3 Moyenne

    Unknown WPBot

    The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

  4. CVE-2026-14189 3.8 Faible

    Unknown WPBot

    The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.

  5. CVE-2026-14185 4.3 Moyenne

    Unknown WPBot

    The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.