3.8
Low
CVE-2026-14189 The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using…
Description
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPBot 8.5 | earliest → < 8.5.2 | 8.5.2 |
Other CVEs of WPBot
The 5 CVEs of WPBot →
CVE-2026-87959
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI…
5.4
Medium
CVE-2026-87918
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions…
5.3
Medium
CVE-2026-87916
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists…
5.3
Medium
CVE-2026-14185
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its…
4.3
Medium