Unknown Wpbot vulnerabilities

5 CVEs affecting Unknown Wpbot, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87959, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-87916, published 2026-09-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name,…
CVE-2026-87918, published 2026-09-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated…
CVE-2026-14189, published 2026-07-27. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL…
CVE-2026-14185, published 2026-07-21. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with…
CVE-2026-87959, published 2026-09-16. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite…