WPBot: AI-powered automated chat support

Download Trends

Loading download data…

Vulnerabilities

44 Total

44 Patched

0 Active

100% Resolved rate

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

CWE-862 · Missing Authorization

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.

5.3 Medium Affected All – 8.5.9 Patched in ✓ 8.6.0 Published 27 Jul 2026 CVE CVE-2026-16774

WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII — including names, email addresses, and phone numbers — stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.

5.3 Medium Affected All – 8.5.9 Patched in ✓ 8.6.0 Published 27 Jul 2026 CVE CVE-2026-16773

WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter

CWE-862 · Missing Authorization

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.

5.3 Medium Affected All – 8.5.6 Patched in ✓ 8.5.7 Published 15 Jul 2026 CVE CVE-2026-15106

WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

CWE-862 · Missing Authorization

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).

4.3 Medium Affected All – 8.5.6 Patched in ✓ 8.5.7 Published 15 Jul 2026 CVE CVE-2026-15610

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

7.2 High Affected All – 8.3.7 Patched in ✓ 8.3.8 Published 6 Jul 2026 CVE CVE-2026-57363

WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection

CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The WPBot AI ChatBot plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 8.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

4.9 Medium Affected All – 8.5.1 Patched in ✓ 8.5.2 Published 6 Jul 2026 CVE CVE-2026-14189

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 8.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

6.1 Medium Affected All – 8.3.2 Patched in ✓ 8.3.3 Published 1 Jul 2026 CVE CVE-2026-57362

WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.

7.2 High Affected All – 8.4.9 Patched in ✓ 8.5.0 Published 30 Jun 2026 CVE CVE-2026-13731

WPBot AI ChatBot <= 8.1.0 - Missing Authorization

CWE-862 · Missing Authorization

The WPBot AI ChatBot plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 8.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

4.3 Medium Affected All – 8.1.0 Patched in ✓ 8.2.0 Published 30 Jun 2026 CVE CVE-2026-14185

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization

CWE-862 · Missing Authorization

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.9.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

4.3 Medium Affected All – 7.9.7 Patched in ✓ 7.9.9 Published 23 Apr 2026 CVE CVE-2026-40788

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection

CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 7.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

7.5 High Affected All – 7.7.9 Patched in ✓ 7.8.0 Published 20 Mar 2026 CVE CVE-2026-32499

ChatBot <= 7.7.3 - Missing Authorization

CWE-862 · Missing Authorization

The ChatBot plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

4.3 Medium Affected All – 7.7.3 Patched in ✓ 7.7.4 Published 13 Oct 2025 CVE CVE-2025-62952

ChatBot <= 7.3.9 - Missing Authorization

CWE-862 · Missing Authorization

The AI ChatBot – WPBot for Live Support and Lead Generation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.3.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

5.3 Medium Affected All – 7.3.9 Patched in ✓ 7.4.0 Published 12 Oct 2025 CVE CVE-2025-64277

AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 7.0.0 Patched in ✓ 7.1.0 Published 19 Aug 2025 CVE CVE-2025-9111

ChatBot <= 6.7.3 - Missing Authorization

CWE-862 · Missing Authorization

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

5.4 Medium Affected All – 6.7.3 Patched in ✓ 6.7.5 Published 27 Jun 2025 CVE CVE-2025-53200

AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 6.2.3 Patched in ✓ 6.2.4 Published 3 Mar 2025 CVE CVE-2025-0329

ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion

CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

The ChatBot plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 6.3.5. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

8.8 High Affected All – 6.3.5 Patched in ✓ 6.3.6 Published 23 Feb 2025 CVE CVE-2025-26932

AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

5.5 Medium Affected All – 5.5.7 Patched in ✓ 5.5.8 Published 16 Jul 2024 CVE CVE-2024-6669

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback

CWE-284 · Improper Access Control

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.

5.0 Medium Affected All – 5.3.4 Patched in ✓ 5.3.6 Published 21 May 2024 CVE CVE-2024-0453

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback

CWE-284 · Improper Access Control

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.

5.0 Medium Affected All – 5.3.4 Patched in ✓ 5.3.6 Published 21 May 2024 CVE CVE-2024-0452

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback

CWE-284 · Improper Access Control

The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.

5.0 Medium Affected All – 5.3.4 Patched in ✓ 5.3.6 Published 21 May 2024 CVE CVE-2024-0451

ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection

CWE-502 · Deserialization of Untrusted Data

The ChatBot with AI plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.0 via deserialization of untrusted input via the last_five_prompt cookies. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

9.8 Critical Affected All – 5.1.0 Patched in ✓ 5.1.1 Published 19 Jan 2024 CVE CVE-2024-22309

ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection

CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The AI ChatBot plugin for WordPress is vulnerable to SQL Injection via the orderby parameter in all versions up to, and including, 4.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for administrators to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

7.2 High Affected All – 4.7.8 Patched in ✓ 4.7.9 Published 23 Nov 2023 CVE CVE-2023-48741

ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. NOTE: This vulnerability is a re-introduction of CVE-2023-4253.

4.4 Medium Affected 4.8.6 – 4.9.6 Patched in ✓ 4.9.7 Published 1 Nov 2023 CVE CVE-2023-5606

AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

9.8 Critical Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5204

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.

9.6 Critical Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5241

AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3.

9.6 Critical Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5212

AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

The ChatBot plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.8.9 via the qcld_wb_chatbot_check_user function. This can allow unauthenticated attackers to extract sensitive data including confirmation as to whether a user name exists on the site as well as order information for existing users.

5.3 Medium Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5254

AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

CWE-862 · Missing Authorization

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

5.3 Medium Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5533

AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actions

CWE-352 · Cross-Site Request Forgery (CSRF)

The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 Medium Affected All – 4.8.9 Patched in ✓ 4.9.1 Published 11 Oct 2023 CVE CVE-2023-5534

ChatBot <= 4.7.8 - Cross-Site Request Forgery via qc_wp_latest_update_check

CWE-352 · Cross-Site Request Forgery (CSRF)

The ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7.8. This is due to missing or incorrect nonce validation on the qc_wp_latest_update_check function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

5.3 Medium Affected All – 4.7.8 Patched in ✓ 4.7.9 Published 3 Oct 2023 CVE CVE-2023-44993

ChatBot <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions up to, and including, 4.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.7.7 Patched in ✓ 4.7.8 Published 8 Aug 2023 CVE CVE-2023-4253

ChatBot 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting in Language Settings

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via Language Settings in versions up to, and including, 4.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.7.7 Patched in ✓ 4.7.8 Published 8 Aug 2023 CVE CVE-2023-4254

AI ChatBot <= 4.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.5.5 Patched in ✓ 4.5.6 Published 25 May 2023 CVE CVE-2023-2811

AI ChatBot <= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings on the 'language' tab in versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.6.0 Patched in ✓ 4.6.1 Published 22 May 2023 CVE CVE-2023-3175

AI ChatBot <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.5.4 Patched in ✓ 4.5.5 Published 22 May 2023 CVE CVE-2023-2742

ChatBot <= 4.4.4 - Unauthenticated Stored Cross-Site Scripting via Cross-Site Request Forgery

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 4.4.4 due to insufficient input sanitization and output escaping and a lack of nonce check on the 'openai_settings_option_callback' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted they can trick an authenticated user into performing an action, such as clicking a link.

6.1 Medium Affected All – 4.4.4 Patched in ✓ 4.4.5 Published 20 Apr 2023 CVE CVE-2023-1011

ChatBot <= 4.4.6 - Unauthenticated PHP Object Injection via Cookies

CWE-502 · Deserialization of Untrusted Data

The ChatBot plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.6 via deserialization of untrusted input from cookies This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

9.8 Critical Affected All – 4.4.6 Patched in ✓ 4.4.7 Published 12 Apr 2023 CVE CVE-2023-1650

ChatBot <= 4.4.8 - Unauthenticated Stored Cross-Site Scripting in Admin Dashboard

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting in the Admin Dashboard in versions up to, and including, 4.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers (leveraging a function hooked to init that lacks authorization and CSRF checks) to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.5 Medium Affected All – 4.4.8 Patched in ✓ 4.4.9 Published 12 Apr 2023 CVE CVE-2023-1660

ChatBot <= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘openai_settings_option_callback’ function in versions up to, and including, 4.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

6.4 Medium Affected All – 4.4.8 Patched in ✓ 4.4.9 Published 12 Apr 2023 CVE CVE-2023-1651

AI ChatBot <= 4.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The AI ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

4.4 Medium Affected All – 4.4.9 Patched in ✓ 4.5.1 Published 12 Apr 2023 CVE CVE-2023-1649

AI ChatBot <= 4.4.7 - Missing Authorization on openai_settings_option_callback

CWE-862 · Missing Authorization

The AI ChatBot plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the openai_settings_option_callback function in versions up to, and including, 4.4.7. This makes it possible for subscriber-level attackers to change plugin settings.

5.4 Medium Affected All – 4.4.7 Patched in ✓ 4.4.8 Published 29 Mar 2023

ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset

CWE-352 · Cross-Site Request Forgery (CSRF)

The ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.8. This is due to missing or incorrect nonce validation on the 'qcld_wb_chatbot_save_options' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (via the 'wp_chatbot_position_x' and 'wp_chatbot_position_y' parameters). This is performed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

5.4 Medium Affected All – 4.2.8 Patched in ✓ 4.2.9 Published 27 Jan 2023 CVE CVE-2023-24415

ChatBot <= 4.3.0 - Authenticated (Admin+) Cross-Site Scripting

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ChatBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘qlcd_wp_chatbot_email_sub’ parameter in versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

4.4 Medium Affected All – 4.3.0 Patched in ✓ 4.3.1 Published 27 Jan 2023 CVE CVE-2022-47613

Support Statistics

4 Support threads

4 Resolved

100% Resolution rate

About WPBot

AI ChatBot for WordPress WPBot - Automated 24/7 Live Chat Customer Support. NATIVE, Lead Generation, Forms, Gemini, DialogFlow, ChatGPT, OpenRouter

AI ChatBot for WordPress – WPBot. Support, Sale, Convert

WPBot is a feature rich AI ChatBot for WordPress websites. Provide 24/7 Automated Live Chat Support, Generate Leads and Convert, Collect Information, or Provide any type of AI Services you want.

A Native, No code ChatBot for WordPress that can work with or without the AI LLM services. Support, Sale, Convert, or Provide any AI services with WPBot.

✅ WPbot can be powered by OpenAI ChatGPT, Gemini, OpenRouter (GPT, Claude, Grok, Cohere, DeepSeek, Mistral, Llama etc.), DialogFlow etc.. Or simply use the built-in features to provide Automated Live Support, Convert Users, and collect data without any extra cost.

🔥 for Advanced Features Upgrade to WPBot Pro now!
🔥 Support, Bug Report, Feature Requests | ChatBot for WordPress Demo

💡 Do you need a ChatBot solution for Agency? Answer: WPBot Pro Master Lifetime deal is for you. White Labelling, 50 sites, Site Activation Control, One time payment – lifetime update, support, and more!

💡 Support customers on multiple channels with WPBot Pro. Your customers are everywhere. Now your chatbot is too. The WPBot ChatBot Pro versions can also support Messenger ChatBot, Instagram ChatBot, Telegram ChatBot, WhatsApp ChatBot, Zapier, WebHooks, Fluent CRM, Hubspot CRM etc.

✅ The ChatBot for WordPress WPBot can work both in Natural Language Processing Mode and Button Menu Driven Mode. WPBot is an AI-powered chatbot for online customer service, to answer user questions about your product or services, and also for Lead Generation and collecting data from the users using conversational forms addon for WPBot.

Change all the WPBot live chat bot responses and make this work in any language with very little effort. RTL is supported. Use this handy ChatBot as a practical means for your website users to save time, improve engagement, generate leads, handle FAQs! It is also great as a HelpDesk, Contact Bot, FAQ Bot or feedback bot to increase user conversions and customer leads.

✅ WPBot pro is available with advanced features like Onsite, and Offsite Retargeting. Integrated Live Chat Support, Messenger ChatBot, Instagram ChatBot, WhatsApp ChatBot, White label chatbot, Chat history logs, analysis, AI Insights, MailChimp, Zapier, Webhook Integration and more!

How does the ChatBot work?

Please check this article for more info on how the ChatBot works.

How to train AI with your website data using ChatBot

You can train an OpenAI model for the ChatBot with your data using one of the three methods: RAG vector database embedding, Fine Tuning or GPT Assistant

How to reduce AI API cost and save money for your ChatBot

You can dramatically decrease the AI API cost by using chatbot for WordPress’s default features (which are free) in combination with paid AI models.
Here is a short guideline for How to reduce AI API cost for your ChatBot

AI ChatBot plugin for WordPress websites

WPBot Free version provides the following ChatBot features:

Built-in, plug n’ play ChatBot features
Supports any languages like French, Spanish etc., including RTL
Create simple text responses easily from your WordPress backend
Upload Custom Icons and Customize Colors to match your brand
Show a List of FAQ or Frequently Asked Questions defined by you
Let users email you any questions or feedback they may have
Let users leave their phone number so you can call them back
Option to display Start Menu After Greetings
Create Conversational drag and drop forms with a free AddOn
Integrate with Google’s Dialogflow Agent API to process natural language queries
Limit AI Interactions by keywords in query
Integrate with OpenRouter and use OpenAI, Anthropic, Google DeepMind, Meta, Mistral, Cohere, xAI, Perplexity AI, DeepSeek or any other popular AI services.
Integrate with Google Gemini
Supports RAG and Vector Database Embedding of Website Contents
Display links to the relevant web pages on your website with all GPT responses
Option for users to Like, Dislike, Share, or Report ChatBot responses

What can you do with WPBot ChatBot?

Use as scalable, automated live support system and personalized, live chat experiences
Use this chatbot for lead generation with conversational forms
Use this chatbot for scheduling appointments or booking
Use this chatbot for lead generation and qualification
Use as a FAQ chatbot for websites
Use this ChatBot for reducing customer support response time
Multilingual chatbot for international customers (Pro feature)
Lower webpage bounce rate
Longer user time on site
Voice-enabled chatbot for customer service (Pro feature)
Collect information and data from the website users

Who can benefit from WPBot ChatBot?

Chatbots can provide valuable benefits to a wide range of businesses by improving customer service, increasing efficiency, and enhancing user engagement. Here are some specific types of businesses that can significantly benefit from implementing chatbots:

🚀 ChatBot for E-commerce and Retail:
– Customer Support: Provide 24/7 assistance, answer FAQs, track orders.
– Sales Assistance: Offer product recommendations, show featured products, and support during the purchasing process.
– Abandoned Cart Recovery: Engage customers who have abandoned their shopping carts with personalized messages and offers.

🚀 ChatBot for Healthcare Industry:
– Appointment Scheduling: Automate the booking of appointments.
– Patient Information: Provide initial information on symptoms, treatments, and healthcare services.

🚀 ChatBot for Financial Services and Banking:
– Customer Service: Handle frequently asked questions, provide information on products and services, and assist with troubleshooting.
– Loan and Credit Applications: Guide users through loan applications.

🚀 ChatBot for Real Estate:
– Lead Generation: Qualify leads by answering property queries and scheduling viewings.
– Customer Support with ChatBot: Provide information on property listings, market conditions, and financing options.
– Virtual Property Tours: Offer virtual tours and answer questions about properties.

🚀 ChatBot for Travel and Hospitality Industry:
– Booking Services: Automate booking of flights, hotels, and vacation packages.
– Customer Support: Assist with cancellations and provide travel information.
– Personalized Recommendations: Offer travel tips, destination information, and personalized vacation packages.

🚀 ChatBot for Education:
– Student Support: Provide information on courses, application procedures, and campus life.
– Tutoring: Offer automated tutoring sessions and study resources.
– Administrative Assistance: Help with enrollment, scheduling

🚀 ChatBot for Human Resources (HR):
– Recruitment: Screen candidates, schedule interviews, and answer job-related questions.
– Employee Support: Assist with onboarding, provide HR policy information, and handle employee queries.
– Performance Reviews: Automate the collection of feedback and performance reviews.

🚀 ChatBot for Customer Service-oriented Businesses:
– Telecommunications: Handle billing inquiries, technical support, and service issues.
– Utilities: Manage service requests, provide outage updates, and assist with billing inquiries.
– Insurance: Help with policy information, claim processing, and provide quotes.

🚀 ChatBot for Marketing and Advertising:
– Lead Generation: Qualify leads and collect customer information.
– Engagement: Run interactive campaigns, quizzes, and promotions.
– Customer Feedback: Collect feedback and conduct surveys to improve services.

🚀 ChatBot for Event Management:
– Event Registration: Streamline the registration process for events, conferences, and webinars.
– Attendee Engagement: Provide event schedules, speaker information, and answer attendee questions.
– Feedback Collection: Gather feedback and reviews from event participants.

🚀 ChatBot for Restaurants and Food Services:
– Order Placement: Automate the ordering process and provide menu recommendations.
– Reservations: Handle table reservations.
– Customer Feedback: Collect reviews and feedback from customers.

WPBOT Pro Version

WPBot Pro version is a multi-language supported chatbot. It is an affordable chatbot services for SMEs to provide multilingual chatbot for international customers.

WPBot AI ChatBot Pro feature highlights

Turn your website into an autonomous customer service and sales engine. WPBot Pro is a next-generation AI ChatBot plugin for WordPress that orchestrates multiple LLMs—including OpenAI ChatGPT, Claude, Gemini, DeepSeek, and Grok—alongside Google Dialogflow CX. Whether you need a RAG-driven knowledge base to answer customer questions, a visual drag-and-drop conversational form builder to capture leads, or an automated conversion tool to recover abandoned WooCommerce carts, WPBot Pro handles it natively from your dashboard.

Next-Gen Multi-LLM & RAG AI Knowledge Base for Chatbot

Advanced Multi-LLM Support: Connect seamlessly to OpenAI ChatGPT, Gemini, or use OpenRouter to access Claude, Grok, DeepSeek, Llama, and Mistral.

RAG Vector Database Embeddings: Train your AI instantly by embedding your live website data, pages, posts, custom post types, or sitemap links into an active vector database.

Document Data Training: Upload corporate training data, product catalogs, and user manuals directly as PDFs, XMLs, CSVs, or JSON files to build a highly contextual custom GPT Assistant.

Interactive Conversational Forms & Lead Capture through Chatbot

Drag-and-Drop Form Builder: Extend your chat’s start menu with a visual form workspace. Build dynamic contact intake, job applications, feedback surveys, and interactive calculators.

Conditional Logic Pathways: Design menu-driven, branches-based conditional conversation tracks that replace old-school, static contact forms.

Google Calendar Scheduling: Allow site visitors to book real-time appointments, consultations, and reservations directly inside the chat interface via Google Calendar.

Instant Marketing Webhooks: Stream captured lead data, email lists, and customer phone numbers straight to any CRM or automated email application.

High-ROI WooCommerce Sales & Cart Recovery

Conversational E-Commerce: Integrate directly with your WooCommerce store to display product catalogs, featured items, flash sales, and active shipping order statuses in-chat.

In-Widget Cart Conversions: Empower shoppers to search for items, view product details, and add products to their shopping cart without leaving the chat window.

Offsite Abandoned Cart Recovery: Deploy automated tracking scripts to recapture lost revenue from shoppers who abandon checkout sessions on your site.

Onsite Behavioral Retargeting with ChatBot

Exit Intent & Scroll Triggers: Deploy behavioral marketing popups and custom chat messages when a user triggers exit intent, scrolls a specific percentage, or lingers on a page.

Browser Tab Flashing: Recapture lost attention by flashing custom dynamic text strings in the visitor’s browser tab when they click away from your website.

Extended UI Controls: Personalize extended home layouts, force the chat window to stay sticky during site browsing, or set the bot window to auto-open on first page load.

Omnichannel Engagement & Live Chat Escalation

Social Media Omnichannel Hub: Route, automate, and control incoming customer messages across Facebook Pages, Instagram, Messenger, WhatsApp, and Telegram profiles.

Hybrid Human Escalation: Give users a clear pathway to transition from AI automation to a live human operator, handling responses via Slack or your WordPress dashboard.

Voice-Enabled Conversational Tech for Chatbot

Bi-Directional Voice Dictation: Provide hands-free accessibility by allowing customers to send spoken voice notes or dictate text, receiving audible, spoken responses back.

ChatBot for Agencies – White Labeling & Deployment

Unlimited Cross-Site Embeds: Install the plugin once and use standard JavaScript embed codes to inject your configured chatbot onto static HTML or external platforms.

White-Label Agency Dashboard: Completely rebrand the backend administration menus and plugin identity to offer a premium, managed chat asset to your clients.

Granular Session Logging: Control persistent user chat histories over single sessions, reset chat trees on page refresh, and access complete GDPR-compliant privacy data configurations.

Deep Analytics & AI Interaction Insights

Daily AI Summary Digests: Receive regular automated email summaries analyzing client behaviors and interactions to quickly identify flaws in your responses.

Conversion Analytics: Access visual analytical charts mapping successful actions, user trends, and comprehensive feedback logs reporting liked or disliked chat interactions.

++ Download Free WPBot from GITHUB
++ Upgrade to WPBot Pro Now!

Screenshots

WordPress Chatbot hard at work

WPBot window Template 1

WPBot window Template 2

WPBot window Template 3

WPBot General Settings

WPBot Language Settings

WPBot Icons and Templates

WPBot FAQ Builder

WPBot Start Menu Builder

WPBot DialogFlow Settings

WPBot OpenAI Settings

WPBot Conversational Form Builder

Frequently Asked Questions

I have a Web Design Agency. What is a good ChatBot solution for Agencies?

WPBot pro Master Lifetime deal is a great solution if you want to give ChatBot services to your customers. You can create both text responses based chatbot or button driven guided conversations, conversational forms, web hooks, Facebook messenger chatbot, Instagram chatbot, all the latest AI technologies and more. Install it on up to 50 WordPress sites, Lifetime deal for the best price and no renewal needed. Best of all, you can white label it and manage your active sites from your account. Check it out.

Does the ChatBot support OpenAI ChatGPT?

OpenAI is now supported with all WPBot WPBot packages. For advanced OpenAI features like fine tuning and GPT Assistants you need the WPBot pro Professional and Master licenses.

How to train AI with your website data using ChatBot

You can train an OpenAI model with your data using one of the two methods (requires WPBot Pro Professional or Master License): Fine Tuning or RAG vector database. We suggest using RAG vector database.

How to save money and reduce OpenAI API cost for your ChatBot

You can dramatically decrease the OpenAI API cost by using chatbot for WordPress’s default features (which are free) in combination with OpenAI.
Here is a short guideline for How to reduce OpenAI API cost for your ChatBot

How do I connect OpenAI ChatGPT to a WordPress website?

You can connect OpenAI ChatGPT to your WordPress website instantly using WPBot Pro. Navigate to the plugin settings backend, paste your OpenAI API key or OpenRouter credentials, and select your preferred LLM model (such as GPT-4o, Claude 3.5 Sonnet, or DeepSeek-V3). The chatbot will immediately start answering visitor questions based on your global settings.

Can I train a WordPress AI chatbot using my site’s pages, sitemaps, and PDFs?

Yes. WPBot Pro features a robust built-in RAG (Retrieval-Augmented Generation) Vector Database engine. You can train the AI by crawling your live sitemap links, syncing custom post types, or uploading external knowledge bases via PDFs, XMLs, CSVs, and JSON files. This creates a fully tailored custom GPT Assistant that only answers questions using your business data.

What is the best WooCommerce chatbot plugin for abandoned cart recovery?

WPBot Pro is widely regarded as a premier WooCommerce chatbot plugin for revenue recovery. It features smart behavioral triggers that deploy targeted marketing messages based on user exit intent, page scroll depth, or inactive browser tabs. It also provides offsite remarketing tools to help recapture customers who abandoned checkout forms mid-session.

How do I build a conversational multi-step form in WordPress without coding?

WPBot Pro includes a native, visual drag-and-drop conversational form builder. Instead of using traditional static contact forms, you can design multi-step interactive chat menus featuring conditional logic pathways. This allows you to build custom lead capture systems, feedback surveys, job applications, cost calculators, and live Google Calendar booking systems directly within the chat widget interface.

Can an AI chatbot escalate website support queries to a live agent via Slack?

Yes. WPBot Pro provides a hybrid automation framework that bridges AI customer support with live human operators. When a user requests human assistance, the bot can pause its autonomous LLM interactions and escalate the issue seamlessly to live support agents monitoring the communication channels inside Slack or the native WordPress dashboard interface.

OpenAI not working. WPBot Keeps loading

If OpenAI is not responding back and the bot is just loading, then likely you hit your OpenAI API usage limit or need to add credit. Please

pre-purchase credit to use OpenAI API and increase the Usage limit. You can add credits to your API account from here: https://platform.openai.com/account/billing

How to get an OpenAI API Key for the WPBot?

Visit your OpenAI API Keys page to retrieve the API key. You can grab the API key for the WPBot from this page: https://platform.openai.com/api-keys

Can I use both DialogFlow and OpenAI GPT3 with the WPBot?

No. They will both NOT work together. Please disable DialogFlow if you want OpenAI to work for the WPBot.

Is my language supported?

WPBot can work with ANY language. Just change the language texts from the WPBot Settings->Change Language to your preferred one.

Does this ChatBot support multi language?

MultiLanguage is supported with the WPBot Pro Master License. For a multilingual ChatBot for international users grab the WPBot.Pro Master License

I am not getting emails from the WPBot

The WPBot WPBot uses the WordPress’ default email function. If you are not getting emails from the WPBot’s email feature, it is likely that no emails are getting through from your WordPress site or they are ending up in the Spam box. Try using an SMTP mailer plugin. Also, try changing the to and from email addresses in the WPBot’s general settings area.

I changed language or some other settings but do not see them when testing

Please clear the browser cache and cookies to see any change you have made. Alternatively, you can open a fresh browser window in incognito mode (Ctrl+Shift+N in chrome) to test your changes. Also, you may need to purge any cache plugin and CDN caching.

Please contact us if you need further help. We take all user feedback sriously.

How do I add new conversations to the WPBot?

You can use WPBot to both answer user questions and collect information from the users.
To create answers to user questions you can use:
Simple Text Responses (built-in), FAQ(built-in), Site search(built-in), Product search(built-in Pro feature), DialogFlow(3rd Party) or LLMs like OpenAI, Gemini, OpenRouter etc.(3rd Party)
To collect information from your users you can use:
Conversational forms(built-in), Mail us(built-in), Call me back(built-in), Collect feedback features(built-in)
The built-in features are all free.

Ratings & Reviews

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

8.6.9

AI Action coming soon

Menu ordering updated

8.6.8

Skip Greetings and Trigger an Intent

8.6.7

Fixed some CSS issues

8.6.6

Improves security

Improved UI

8.6.5

Responsive Width and Height issue Fixed

8.6.4

Bot Sessions UI Updates

8.6.2

AI Wizard skip alart box removed

Ragg for DB table demo update

8.6.1

Fixed the email greeting enable issue

changed default FAQ

changed session actions button label

8.6.0

Major Admin UI update

Improved security

8.5.9

UI update for chatwindow

email greetings option added

user data option added

start menu default item added

8.5.8

Fixed “AI Settings” issue

Fixed RTL issue

8.5.7

Fixed prompt save issue

Improved security

8.5.6

back to start menu disable issue fix

css issue fixed on wpbot paragraph

8.5.5

More system prompts

Improved security

8.5.4

Added Options for Default System Command for OpenAI

Added options for Post Meta Data Settings in RAG

8.5.3

AI Settings updated

8.5.2

Improved Security

8.5.0

Improved Security

8.4.9

Added Chat sessions and histories

added Automator support

chat session added

8.4.8

language file update for hello translate issue

8.4.7

Fixed conflict with Pro

8.4.6

Added API key links

8.4.4

UI Update

8.4.3

Improved code quality

Fixed some responsive issues

8.4.2

UI Update

8.3.9

“AI Wizard” Feature design update

8.3.8

Improved security

8.3.7

Updated default system command

8.3.6

Introducing AI Wizard

8.3.5

RAG KB Design Updated

8.3.4

Fixed an issue with language center

8.3.3

Improved security

Improved RWD

8.3.2

Improved security

Theme One Avatar icon issue fixed

Theme Basic” Design updated

Rag manage page update

8.3.1

Add “Expand” Feature

“Theme One” design Updated

8.3.0

Fixed session count 403 error

8.2.9

Fixed email sending issue

8.2.8

Fixed some CSS issues

8.2.7

Added streaming support for OpenAI

8.2.6

language center switcher bug fixed

8.2.5

“WPBot Icon’s Position” feature updatated

8.2.4

responsive issue fixed for template 01

language translation fixed for Chinese

8.2.3

OpenAI, Gemini response issue fixed

Rate limit settings saving issue fixed

8.2.2

“RAG Settings” Link updated

“RAG” Documentation link updated

Fixed some CSS issues

8.2.1

Fixed AI model changing bug

8.1.0

RAG Settings Link updated

RAG Documentation link updated

Fixed some CSS issues

8.0.0

skip greetings and start menu missing issue fixed

7.9.9

Improved security

AI rate limit feature added

7.9.8

Fixed some CSS issues

7.9.7

fixed the site search load more

added API instruction on all AI settings

7.9.6

Added AI status checking for OpenRouter

Fixed OpenRouter RAG issues

7.9.5

Added AI status checking for Gemini

7.9.4

Updated alert for OpenAI save settings

7.9.3

Improved Admin UI

7.9.2

Gemini Admin UI updated

GROK Admin UI updated

7.9.1

“Help and Debugging” section updated

grok empty instruction issue fixed

greeting disabled name showing issue fixed

7.9.0

Fixed FAQ Icon Issue

7.8.9

added Gemini Model Selection

7.8.8

added GROK AI Support

7.8.7

added a tutorial link

Improved security

7.8.6

added a notice for RAG

7.8.5

added wpbot after search field

STR edit accesses option for author and editor

7.8.4

disable floating icon option added

disable back to start option added

7.8.3

Fixed embedding issue without RAG enabled

7.8.2

Fixed an API issue with Gemini

7.8.1

UI Update

7.8.0

Improved security

7.7.9

Fixed an issue with Gemini Integration

7.7.8

Fixed some CSS conflicts

7.7.7

Improved RAG Admin UI

7.7.6

Improved RAG UI

7.7.5

Improved FAQ

7.7.4

Improved security

7.7.3

Fixed some CSS conflicts

7.7.2

Fixed site search loader

Added STR to RAG

7.7.1

Improved Admin UI

7.7.0

End Sale

7.6.9

Improved CSS

7.6.8

Added RAG for OpenRouter and Gemini

Updated chat reaction options default enable

7.6.7

Introducing RAG

7.6.6

Admin area updated

7.6.5

Admin area updated

7.6.4

Horizontal theme design updated

7.6.3

New year Sale

7.6.2

Fixed default template width

7.6.1

Fixed an issue with the name variable

7.6.0

Increased width for theme 1

7.5.9

Admin area updated

7.5.8

Fixed a warning

7.5.7

Dash Icons updated

7.5.6

End sale

7.5.5

Removed fontawesome icon library

Added WordPress dashicons icon library

fixed the wpdb::prepare() warning

7.5.4

Fixed some warnings

7.5.3

“Custom Styles Option” Updated

7.5.2

UI Update

7.5.1

Cyber Monday sale

7.5.0

Support page design issue Fixed

Fixed some CSS conflicts – STR page

Default Template Button design updated

7.4.9

Improved CSS

7.4.8

Added more language options

7.4.7

Blackfriday sale

7.4.6

Added auto language translation

7.4.5

Fixed icon issues

7.4.4

Custom Style Options

7.4.3

Fixed 2 color customization fields

7.4.2

Fixed chatbot keywords in language center

7.4.1

Fixed settings save issue

7.4.0

Fixed an issue with GPT 5

7.3.9

Updated label

7.3.8

Fixed custom color issue

7.3.7

End sale

7.3.6

“Theme Basic” UI update

7.3.5

Improved chat interface

7.3.4

Fixed banner issue

7.3.3

Halloween sale

7.3.2

Updated OpenAI help

7.3.1

Added new help area

7.3.0

Fixed some CSS conflicts

Fixed Custom Style Options

Fixed Upload custom Icon

7.2.9

Fixed custom image upload and color issues

7.2.8

Code optimization and security fixes

7.2.6

Updated display text and readme text

7.2.5

Fixed conflict with Visual composer

7.2.4

Default “Agent Image” issue Fixed

7.2.3

Fixed a conflict with Visual composer shortcode

7.2.2

Backend changed

7.2.1

CSS fixes

7.2.0

UI Update

7.1.9

Updated some text

7.1.8

UI updated

7.1.7

Styles updated

7.1.6

Fixed some JS conflicts

7.1.5

Fixed some CSS conflicts

7.1.4

Dialogflow section updated

Fix free plugin with pro installation issue

7.1.3

Removed model name before the list

Replace the STR default response

7.1.2

GPT 5 support

7.1.1

Fixed CSS conflicts

7.1.0

Improved security

7.0.0

Removed other plugin notifications

6.9.9

Added context awareness

6.9.8

Gemini Support, OpenAI Settings and Help updated

6.9.7

Updated STR and Start Menu areas

6.9.6

Added notice about AI

6.9.5

Fixed Site Search Load more issue

6.9.4

Updated Site Search

6.9.3

Fixed FAQ text

6.9.2

Text Domain issue fixed

Notification issue Fixed

Admin UI updated

6.9.1

Updated default template to IOS glass design

6.9.0

Icons updated

6.8.9

Updated Icons

6.8.8

Fixed an issue with the Start menu button

6.8.7

Improved RWD

6.8.6

Fixed some Responsive Issues

6.8.5

Fixed a modal alert

6.8.4

Removed the sale banner

6.8.3

Improved backend RWD

6.8.2

UI Update

6.8.1

4th of July Sale

6.8.0

Fixed start menu drag and drop

6.7.9

Backend Overhaul

6.7.8

UI Update

6.7.7

Updated support link

6.7.6

Admin menu update

6.7.5

Improved security

6.7.4

Optimized code

More options for OpenRouter

6.7.3

End Sale

6.7.2

Admin area update

6.7.1

Removed AI content generator

6.7.0

UI Update

6.6.9

Happy Birthday WordPress

6.6.8

UI Update

6.6.7

UI Update

6.6.6

UI Update

6.6.5

Added Openrouter support

6.6.4

UI Update

6.6.3

AI Content Generation

6.6.2

Settings menu update

6.6.1

Admin area update

6.6.0

UI Update

6.5.9

Admin area update

6.5.8

UI Update

6.5.7

End Easter Sale

6.5.6

Added new AI models

6.5.5

Easter Sale

6.5.4

UI update

6.5.3

Design update

6.5.2

UI update

6.5.1

Improved Simple Text Responses keyword search

6.5.0

AI Model reporting update

6.4.9

UI Update

6.4.8

UI Update

6.4.7

Fixed a CSS issue

6.4.6

Added option to Skip asking for name

6.4.5

UI Update

6.4.4

Fixed a global CSS class

6.4.3

UI Update

6.4.2

UI Update

6.4.1

Fixed a Global CSS issue

6.3.9

UI Update

6.3.8

Added option to open all links in new window

6.3.7

UI Update

6.3.6

Removed some unused functions

6.3.5

UI Update

6.3.4

Fixed Woocommerce product links

6.3.3

UI Update

6.3.2

Improved responsiveness

6.3.1

Enable site search for all post types

6.3.0

Replaced Start menu with Back to start button

6.2.8

Improved CSS

6.2.7

UI Update

6.2.6

Fixed broken button

6.2.5

Fixed some CSS issues

6.2.4

End Sale

Improved security

6.2.2

UI Update

6.2.1

Fixed some CSS conflicts

6.1.9

Fixed an Inline CSS issue

6.1.8

Admin UI Update

6.1.7

Fixed some global CSS issues

6.1.6

Admin UI Update

6.1.5

New year Sale

6.1.4

Admin UI Update

6.1.3

Admin UI Update

6.1.2

New Year Sale

6.1.1

Fixed faq CSS issue

6.0.9

Fixed faq CSS issue

6.0.8

Improved RWD

6.0.7

Ended sale

6.0.6

Updated some depreciated code

6.0.5

Fixed some CSS conflicts

6.0.4

Admin UI update

6.0.3

Cyber Monday Sale

6.0.2

UI Update

6.0.1

Updated GPT Assistant Instructions

6.0.0

Fixed an issue with banner

5.9.9

Black Friday Sale

5.9.8

Updated Icons

5.9.6

UI Update

5.9.5

End Sale

5.9.4

UX Update

5.9.3

UI Update

5.9.2

Halloween Sale

5.9.1

Markdown support for OpenAI responses

5.9.0

Fixed Accordion

5.8.9

Updated OpenAI Help section

5.8.8

UI update

5.8.7

UX update

5.8.6

Updated OpenAI API key field

5.8.5

Updated OpenAI Settings

5.8.4

GPT 4o Mini Support added

5.8.3

UI update

5.8.1

UI update

5.8.0

UI update

5.7.9

Fixed FAQ buttons

5.7.8

Fixed an issue with empty FAQ

5.7.7

Small UI Update

5.7.6

Fixed a CSS issue send message bar

5.7.5

Fixed a CSS issue in admin settings

5.7.4

End sale

5.7.3

Updated Start menu settings

5.7.2

Fixed issue with Start Menu settings

5.7.1

Updated admin settings UI

5.7.0

Labor day sale

5.6.9

Updated OpenAI settings page and Start menu behavior

5.6.7

Fixed a new line issue in conversational form

5.6.6

Fixed support page loading issue

5.6.4

Updated a link

5.6.3

Updated OpenAI Help

5.6.2

Removed an unneeded field

5.6.1

Basic HTML tag support for the language center

5.6.0

Updated a function name to avoid conflict

5.5.9

Updated support page with AJAX

5.5.8

Improved security

5.5.7

Updated the menu label

5.5.6

Fixed an issue with conversational forms for ChatBot

5.5.5

End sale

5.5.4

Updated some text

5.5.3

4th of July Sale

5.5.2

Fixed an issue with DialogFlow WPBot

5.5.1

Fixed some text and UI

5.5.0

Added some text about custom Icons

5.4.9

Updated some text about GPT Assistant

5.4.8

Fixed an issue with a setting not getting saved

5.4.7

Added relevant page links feature to GPT responses

5.4.6

Removed conversation continuity option for now

5.4.5

Fixed an error with the Horizontal template

5.4.4

Updated the support section

5.4.3

Default template UI update

5.4.2

Improved Site Search result display

5.4.1

Cleaned up UI and some spelling mistakes

5.3.9

Added GPT 4o support

Fixed an issue with FAQ

5.3.8

Improved security

5.3.7

Improved security

5.3.6

Removed unnecessary functions

Improved security

5.3.4

Text Update

5.3.3

UI Update

5.3.2

Fixed a PHP error for downgrading

5.3.1

Updated some text

5.3.0

Updated some text

5.2.9

Conversational form builder

5.2.8

GPT Assistant

5.2.7

UI Update

5.2.6

Remove Eid sale

5.2.5

UI update

5.2.4

Eid sale for WPBot

5.2.3

Fixed a link

5.2.2

Added instructions

5.2.1

Text update

5.2.0

UI update

5.1.9

UI update

5.1.8

Hide the button for conversational form builder

5.1.7

Updated some instruction text

5.1.6

Select default OpenAI model

5.1.5

Improved the reset option

5.1.4

Removed unnecessary field from WPBot OpenAI settings

5.1.3

WPBot UI improvement for STR

5.1.2

Removed NY sale banner for WPBot

5.1.1

Updated cookies in WPBot openAI

Removed WPBot openAIs’ old models

5.1.0

Fixed an image path

5.0.9

New Year Sale

5.0.7

Christmas Sale

5.0.6

When WPBot OpenAI is enabled create a popup and ask if we should disable Site Search.

5.0.5

Removed BF Sale

5.0.4

Fixed a PHP error

5.0.3

Fixed a PHP warning

5.0.2

BF Sale

5.0.1

BF Sale

4.9.9

Fixed custom CSS loading

4.9.8

Removed Halloween sale

4.9.7

Improved security for FAQ

4.9.6

Halloween sale

4.9.5

Fixed custom icon issue

4.9.4

WPBot Fixed a broken image issue

4.9.3

Removed OpenAI unnessary functions

fixed a php7.2 syntex error

4.9.2

Added Visual Editor for STR

OpenAI keyword Case fixed

4.9.1

Improved security

Removed unnecessary functions

4.8.9

Minor UI Update

4.8.8

Fixed a PHP warning

4.8.7

Fixed FAQ fatal error

4.8.6

Fixed HTML issue in FAQ

4.8.5

Removed admin notice

4.8.4

Added admin notice

4.8.3

UI update

4.8.2

Added Site Search feature

4.8.1

Small UI update

4.8.0

Fixed an issue with OpenAI settings save

4.7.9

Improved security for STR indexing as admin

4.7.8

Improved security for FAQ saving as admin

4.7.7

UI Update for WPBot

4.7.6

Fixed slash issue in language center

4.7.5

Fixed JS issue on the dialogflow page

4.7.4

Removed notice about new template

4.7.3

Fixed FAQ issue

4.7.2

Fixed a conflict with FluentSMTP

4.7.1

Removed Sale notice

4.7.0

Sale notice

4.6.9

WPBot UI Changes

4.6.8

WPBot Fixed horizontal template mobile display issue

4.6.7

WPBot Fixed duplicate notice on the Start Menu page

4.6.6

Fixed empty keyword issue on OpenAI settings

4.6.5

Updated UI

Fixed OpenAI include/Exclude keyword issue

4.6.3

added horizontal chat template

change openAI settings page text

4.6.2

Fixed custom post type exclude not saving issue

4.6.1

Exclude include keyword option for openAI

Fix the exclude custom post

Security check on admin settings

4.6.0

Improved UI

4.5.9

Minor UX improvements

4.5.8

Fixed issue with Dialogflow connection button

4.5.7

Fixed show start menu after greetings option chekcing

4.5.6

Fixed back to start button

Sanitization for WPBot keywords area for admin user role

4.5.5

Sanitization for STR area for admin user role

4.5.4

back to start button button for fixed for different language

reset command fixed

4.5.3

Fixed issues with STR

4.5.2

Added WPBot in a Nutshell

fix no answer found message

fix search field filter on STR

4.5.1

Improved security for Settings

3.8.1

Fixed the issue with Call me intent getting stuck

3.8.0

Improved responsiveness

3.7.9

Improved responsiveness

3.7.8

Fixed a database table name issue

3.7.7

Removed some test code/text

3.7.6

Added more debugging info

Re-indexing button added.

3.7.5

Improved the Help section

3.7.4

Added Custom CSS option

3.7.3

option Save issue fixed.

Tested with wp 5.7

Email us intent json issue fixed.

Button design issue fixed.

3.7.2

Uncaught Error: Call to a member function close() on bool – fixed.

3.7.1

Refactored and improved code

Remove Unused Files

Make WPBot Fulscreen on Mobile option default

Fix Close icon on Mobile

3.7.0

Improved default template button design

Added help notice

3.6.9

Improved close button

Improved loading issue

3.6.8

Fixed close button

Fixed loading issue

3.6.7

Improved mobile view

3.6.6

MYsql version notice issue fixed.

3.6.5

Added required mysql version notice

3.6.4

WP 5.6, PHP 8 Cpmpatible

3.6.3

Removed sale notice

3.6.2

Text box block issue for iphone 6 – fixed.

3.6.1

Improved STR

Fixed an issue on iphone

3.6.0

Fixed duplicate notice

3.5.9

Improved UX

3.5.8

Updated Support Link Notice

3.5.7

Rating request added.

Dialogfow Project ID & Language field is marked required now.

New tutorial link added.

3.5.6

Improved responsiveness

3.5.5

Set default response delay to 0.5 sec

3.5.4

Chat window size increased like the pro version.

WPBot logo removed from chat window background.

3.5.3

Disable a default feature will automatically remove the item from the Start Menu

Bot Response Delay option added.

Bottom icons title added.

Help Section updated.

From email address field added in general settings.

3.5.2

Improved Help page UI

3.5.1

Added more info on how to use the WPBot WPBot

3.5.0

Improved Help and Tips

3.4.9

Recfactored code for more stability

3.4.8

Fixed a conflict with FooBox plugin

3.4.7

Add mysql version requirement message

3.4.6

wc_setcookie function is exists check added.

3.4.5

Dialogflow Test Connection Error message added.

3.4.4

Full screen support under 1024px – done.

Backslash issue fixed for language center

3.4.3

DF Tutorial link updated.

3.4.2

DF Tutorial link updated.

Button design updated

Dialogflow owner permission required notice added.

3.4.1

Typing area block issue on mobile fixed.

3.4.0

Improved Simple Text Responses

3.3.9

Fixed a conflict with the oxygen page builder

3.3.8

Multiple back to start button issue fixed

3.3.7

Improved Simple Text responses

3.3.6

Fixed an error with full text search – too many keys specified.

3.3.5

Added notice for Df section and Start menu

3.3.4

Don’t load resources globally when loaded Selected page only

3.3.3

Show on pages > Selected page only – undefined function issue fixed.

3.3.2

Fixed bug with page specific WPBot loading

3.3.1

Simple text response search improved and bug fixed

3.2.9

Added new feature – Simple text response

3.2.8

Admin area language changed – System Keyword->WPBot Keyword.

New template added

Disable WPbot on Mobile Device option added in general settings.

3.2.7

Fixed timezone issue

3.2.6

Dialogflow Connection test button added

Form Builder first response html – issue fixed.

3.2.5

Improved Start Menu Options

3.2.3

Improved deactivation module

3.2.2

Compatible with Messenger WPBot addon free.

Custom rest api endpoind created for Dialogflow api

3.2.1

DF v2 client download script updated.

WPBot panel updated.

Addon page updated.

3.2.0

Improved Admin UI

Added option Show Start Menu after Greetings

Mobile fullscreen mode close icon issue fixed.

Call to undefined function wc_get_product() – issue fixed.

3.1.0

DialogFlow V2 compatibility added

3.0.1

Improved some CSS and button styles

3.0.0

Added support for conversational forms WPBot addon

2.9.6

Added support for multiple responses from dialogflow

2.9.5

Fixed some conflict with a custom theme

2.9.4

Fixed the support icon in the front end WPBot

2.9.3

Improved Support area.

2.9.2

Improved Help area.

2.9.1

Custom Agent image upload option added.

2.9.0

Added custom admin email option

2.8.0

Notice: Undefined index issue fixed.

2.6.0

More Notice: Undefined index issue fixed.

2.5.0

Notice: Undefined index issue fixed.

2.4.0

Notice: Undefined index issue fixed.

Free support link added.

2.3.0

WPBot open full screen in mobile option added.

2.2.0

Added addon section

2.1.0

Added a banner

2.0.0

Fixed a PHP warning

1.9.0

Improved deactivation survey

1.8.0

Conflict with woowbot fixed.

Agent download issue fixed.

Deactivate feedback updated.

1.7.0

Introducing the pro version

1.6.0

Removed site search feature

Added DialogFlow Integration

1.5.0

Added site search feature

1.3.0

Added call me back feature

Upload custom bot icon

1.2.0

Improved User input text sanitization added.

1.0.0

Default message updated.

New icon added as agent & WPBot icon.

Support changed to FAQ

0.9.0

*Inception

Alternatives to WPBot

Other WordPress plugins serving a similar purpose, ranked by relevance and PF Score.

Gold73.6

AI Bud

AI Bud an AI Content & Image Generation, AI ChatBot, ChatGPT, OpenAI, Perplexity, Gemini, GPT-4o, LLAMA, Mistral

★ 4.5/5·2K+ installs·Updated 16 Aug 2026

Platinum92.2

AI Engine

Integrates AI models into WordPress for chatbots, content generation, and automated responses.

★ 4.9/5·100K+ installs·Updated 14 Aug 2026

Platinum89.4

Chatway Live Chat

Live chat and AI chatbot for customer support with WhatsApp integration and mobile apps.

★ 5/5·30K+ installs·Updated 13 Aug 2026

Platinum88.9

3CX Free Live Chat, Calls & Messaging

Enables real-time chat and messaging with website visitors at no cost to site owners.

★ 4.6/5·100K+ installs·Updated 29 Jun 2026

Platinum87.9

Tidio – Live Chat & AI Chatbots

Live chat tool for answering customer questions and generating leads on WordPress sites.

★ 4.7/5·70K+ installs·Updated 16 Jun 2026

Gold84.7

Buttonizer

Add live chat, chatbots, and contact buttons to increase conversions on your site.

★ 5/5·50K+ installs·Updated 13 Aug 2026

Gold82.7

AI Puffer

Chat and content automation tool powered by Claude and OpenAI integrations.

★ 4.6/5·10K+ installs·Updated 18 Aug 2026

Gold79.8

LiveChat – Live Chat Plugin for WP Websites

Add a live chat widget to WordPress for real-time customer support and visitor engagement.

★ 4.6/5·10K+ installs·Updated 25 May 2026

Gold78.7

Live Chat by Formilla

Offer live chat to visitors or use chatbot automation for self-help support and visitor engagement.

★ 4.8/5·2K+ installs·Updated 17 Aug 2026

Gold78.1

Smartsupp

Live chat and chatbot solution designed to engage visitors and support online sales conversations.

★ 4.7/5·20K+ installs·Updated 8 Dec 2025

Gold77.1

AI Agent by SiteGround

Manage WordPress sites, create content, and install plugins using an AI agent interface.

★ 1.5/5·1.0M+ installs·Updated 29 Jul 2026

Gold76.2

Royal MCP

Security-first MCP server. Connect Claude, ChatGPT & Gemini to WordPress with API key auth, rate limiting, audit logs, and Elementor…

★ 5/5·10K+ installs·Updated 12 Aug 2026

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

PF Score (About PF Scores)

Score Breakdown

Download Trends

Vulnerabilities

Support Statistics

About WPBot

AI ChatBot for WordPress – WPBot. Support, Sale, Convert

How does the ChatBot work?

How to train AI with your website data using ChatBot

How to reduce AI API cost and save money for your ChatBot

AI ChatBot plugin for WordPress websites

What can you do with WPBot ChatBot?

Who can benefit from WPBot ChatBot?

WPBOT Pro Version

WPBot AI ChatBot Pro feature highlights

Next-Gen Multi-LLM & RAG AI Knowledge Base for Chatbot

Interactive Conversational Forms & Lead Capture through Chatbot

High-ROI WooCommerce Sales & Cart Recovery

Onsite Behavioral Retargeting with ChatBot

Omnichannel Engagement & Live Chat Escalation

Voice-Enabled Conversational Tech for Chatbot

ChatBot for Agencies – White Labeling & Deployment

Deep Analytics & AI Interaction Insights

Screenshots

Frequently Asked Questions

Ratings & Reviews

Recent Reviews

Changelog

8.6.9

8.6.8

8.6.7

8.6.6

8.6.5

8.6.4

8.6.2

8.6.1

8.6.0

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.0

8.4.9

8.4.8

8.4.7

8.4.6

8.4.4

8.4.3

8.4.2

8.3.9

8.3.8

8.3.7

8.3.6

8.3.5

8.3.4

8.3.3

8.3.2

8.3.1

8.3.0

8.2.9

8.2.8

8.2.7

8.2.6

8.2.5

8.2.4

8.2.3

8.2.2

8.2.1

8.1.0

8.0.0

7.9.9

7.9.8

7.9.7

7.9.6

7.9.5