Quantumcloud vulnerabilities, page 4
94 vulnerabilities
Known vulnerabilities in Quantumcloud products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 27 products.
CVE-2026-53742quantumcloudsimple_link_directory
EPSS score0.24%
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.CVE-2026-53741quantumcloudsimple_link_directoryEPSS score0.24%
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.CVE-2026-57710quantumcloudwoowbot pro max+1EPSS score0.48%
Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.CVE-2026-57363quantumcloudchatbot+1EPSS score0.25%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.CVE-2026-57707quantumcloudsimple business directory pro+1EPSS score0.40%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.CVE-2026-57414quantumcloudchatbot for ecommerce – woowbot+1EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce – WoowBot: from n/a through <= 4.6.1.CVE-2026-57682quantumcloudsimple_link_directory+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.CVE-2026-57362quantumcloudchatbot+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.CVE-2026-83593quantumcloudwpbot – ai chatbot for live support, lead generation, ai services+1EPSS score0.53%
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.CVE-2026-95531quantumcloudconversational forms for chatbot+1EPSS score0.48%
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.CVE-2026-15106quantumcloudwpbot – ai chatbot for live support, lead generation, ai services+1EPSS score0.47%
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.CVE-2026-15610quantumcloudwpbot – ai chatbot for live support, lead generation, ai services+1EPSS score0.40%
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).CVE-2026-32499quantumcloudchatbot+1EPSS score0.40%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.CVE-2023-2742quantumcloudwpbot+2EPSS score0.47%
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.CVE-2023-2811quantumcloudwpbot+2EPSS score0.44%
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbotCVE-2023-1011quantumcloudwpbot+2EPSS score0.24%
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.CVE-2023-1649quantumcloudwpbot+2EPSS score0.44%
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2023-1650quantumcloudwpbot+2EPSS score34.35%
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blogCVE-2023-1651quantumcloudwpbot+2EPSS score0.24%
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSSCVE-2023-1660quantumcloudwpbot+2EPSS score0.27%
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard