Quantumcloud

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Quantumcloud product.

RSS Feeds for Quantumcloud security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Quantumcloud products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Quantumcloud Sorted by Most Security Vulnerabilities since 2018

Quantumcloud Wpbot35 vulnerabilities

Quantumcloud Ai Chatbot23 vulnerabilities

Quantumcloud Chatbot12 vulnerabilities

Quantumcloud Simple Link Directory12 vulnerabilities

Quantumcloud Slider Hero6 vulnerabilities

Quantumcloud Simple Video Directory2 vulnerabilities

Quantumcloud Simple Business Directory Pro2 vulnerabilities

Quantumcloud Knowledgebase Helpdesk Pro2 vulnerabilities

Quantumcloud Wpot1 vulnerability

Quantumcloud Woowbot Pro Max1 vulnerability

Quantumcloud Kbx Pro Ultimate1 vulnerability

Quantumcloud Infographic Maker1 vulnerability

Quantumcloud Highlight1 vulnerability

Quantumcloud Floating Buttons1 vulnerability

Quantumcloud Floating Action Buttons1 vulnerability

Quantumcloud Conversational Forms Chatbot1 vulnerability

Quantumcloud Comment Link Remove Other Comment Tools1 vulnerability

By the Year

In 2026 there have been 23 vulnerabilities in Quantumcloud with an average score of 6.8 out of ten. Last year, in 2025 Quantumcloud had 16 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.11

Year	Vulnerabilities	Average Score
2026	23	6.81
2025	16	6.92
2024	12	5.85
2023	24	6.19
2022	3	8.13
2021	2	6.55
2020	1	0.00

It may take a day or so for new Quantumcloud vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Quantumcloud Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-95531	Sep 30, 2026	PHP Object Injection in Conversational Forms <= 1.5.0 Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.	Chatbot
CVE-2026-83593	Sep 09, 2026	WPBot 8.7.3 Stored XSS via 'conversation' param (nonce ineffective) The WPBot AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The action is gated only by a nonce that is localized into every public-facing page via wp_localize_script, rendering the nonce check ineffective as an access control barrier for unauthenticated users.	Wpbot
CVE-2026-17582	Aug 16, 2026	WordPress Slider Hero <=9.1.7 SecondOrder SQLi via heroduplicateslider The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Slider Hero
CVE-2026-16773	Jul 28, 2026	WPBot 8.5.9 Vulnerable: Sensitive Info Exposure via wpbot_send_email_transcript_free The WPBot AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot_send_email_transcript_free. This makes it possible for unauthenticated attackers to exfiltrate full chat transcripts and associated user PII including names, email addresses, and phone numbers stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.	Wpbot
CVE-2026-16774	Jul 28, 2026	WP Chatbot Plugin 8.5.9: Missing Auth in wpcs_send_email AJAX The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_send_email and wp_ajax_nopriv_wpcs_send_email with no nonce verification, capability check, or rate limiting, while forwarding attacker-controlled recipient, subject, and body directly to wp_mail(). This makes it possible for unauthenticated attackers to send arbitrary emails to any recipient from the site's domain, enabling spam, phishing, and abuse that can lead to the site's IP/domain being blacklisted.	Wpbot
CVE-2026-61953	Jul 27, 2026	Simple Link Directory Pro SSRF before 15.0.6 Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.	Simple Link Directory
CVE-2026-61981	Jul 23, 2026	CSRF in Simple Link Directory Pro <= 15.0.8 (Unauthenticated) Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.	Simple Link Directory
CVE-2026-15610	Jul 16, 2026	Authorization Bypass in WPBot AI ChatBot 8.5.6 RAG Document Abuse The WPBot AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger arbitrary re-embedding of stored RAG documents, modifying the rag_documents table and consuming the site owner's paid third-party AI API credits (OpenAI, Gemini, OpenRouter, or xAI).	Wpbot
CVE-2026-15106	Jul 16, 2026	WPBot Plugin Auth Bypass (8.5.6) Allows Deletion of Chat Records The WPBot AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.	Wpbot
CVE-2026-57710	Jul 13, 2026	QuantumCloud WoowBot Pro Max <=14.1.7 Unrestricted File Upload CVE-2026-57710 Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbot-pro-max allows Using Malicious Files.This issue affects WoowBot Pro Max: from n/a through <= 14.1.7.	Woowbot Pro Max
CVE-2026-57707	Jul 13, 2026	SQL Injection in Simple Business Directory Pro <=15.9.4 (Quantumcloud) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.	Simple Business Directory Pro
CVE-2026-57414	Jul 13, 2026	Stored XSS in WoowBot <=4.6.1 (WordPress) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce – WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce – WoowBot: from n/a through <= 4.6.1.	Chatbot
CVE-2026-57363	Jul 13, 2026	QuantumCloud ChatBot Stored XSS before v8.3.8 (CVE-2026-57363) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.	Chatbot
CVE-2026-57682	Jul 02, 2026	Unauthenticated XSS in WP Simple Link Directory <=15.0.5 Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.	Simple Link Directory
CVE-2026-57362	Jul 02, 2026	Unauth XSS in ChatBot <= 8.3.2 Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.	Chatbot
CVE-2026-13731	Jul 01, 2026	Stored XSS in WPBot <8.4.9 via 'conversation' param, AJAX nonce leaked The WPBot AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.	Wpbot
CVE-2024-32729	Jun 17, 2026	QuantumCloud Conversational Forms for ChatBot Path Trv (<1.1.8) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal. This issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.	Chatbot
CVE-2025-60223	Jun 17, 2026	WPBot Pro <=13.6.5: Arbitrary File Deletion via Subscriber Exploit Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.	Wpbot
CVE-2026-40788	Jun 15, 2026	ChatBot <=7.9.7: Subscriber Broken Access Control Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.	Chatbot
CVE-2026-53742	Jun 10, 2026	Simple Link Directory 9.0.4 XSS via unescaped embed shortcode attributes Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.	Simple Link Directory
CVE-2026-53741	Jun 10, 2026	Simple Link Directory <=9.0.4 XSS via sld_no_results_found Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.	Simple Link Directory
CVE-2026-7209	May 02, 2026	Simple Link Directory WP Plugin <=8.9.2 Stored XSS via qcopd-directory The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in all versions up to, and including, 8.9.2. This is due to insufficient input sanitization and output escaping on user supplied attributes such as `title_font_size`. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Simple Link Directory
CVE-2026-32499	Mar 25, 2026	QuantumCloud ChatBot <=7.7.9 Blind SQLi Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.	Chatbot
CVE-2025-67576	Dec 09, 2025	QuantumCloud Simple Link Directory <=8.8.3 Missing Auth due to Wrong ACL Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.	Simple Link Directory
CVE-2025-67465	Dec 09, 2025	CSRF in QuantumCloud Simple Link Directory <=8.8.3 Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.	Simple Link Directory
CVE-2025-64277	Nov 13, 2025	QuantumCloud ChatBot <7.3.9 : Missing Auth Exploit (Incorrect ACL) Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.3.9.	Chatbot
CVE-2025-62952	Oct 27, 2025	QuantumCloud ChatBot 7.3.0 Missing Auth Exploits Insecure Access Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.	Chatbot
CVE-2025-60232	Oct 22, 2025	QuantumCloud KBx Pro Ultimate <=8.0.5 Deserialization Object Injection Deserialization of Untrusted Data vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Object Injection.This issue affects KBx Pro Ultimate: from n/a through <= 8.0.5.	Kbx Pro Ultimate Knowledgebase Helpdesk Pro
CVE-2025-49901	Oct 22, 2025	Auth Bypass in QuantumCloud Simple Link Dir < 14.8.1 via Alternate Path Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.	Simple Link Directory
CVE-2025-31053	May 23, 2025	quantumcloud KBx Pro Ultimate Path Traversal <8.0.5 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.	Knowledgebase Helpdesk Pro
CVE-2025-31918	May 23, 2025	QuantumCloud SBDP <15.4.8: Priv Escal via Improper Priv Assign Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.	Simple Business Directory Pro
CVE-2025-0329	May 15, 2025	Stored XSS in WP AI ChatBot Plugin Settings <=6.2.4 The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	Wpbot
CVE-2024-6809	May 15, 2025	SQLi in Simple Video Directory WP Plugin <1.4.3 (Unsanitised AJAX) The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.	Simple Video Directory
CVE-2025-26932	Feb 25, 2025	QuantumCloud ChatBot 6.3.5 LFI via PHP Include/Require Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through <= 6.3.5.	Chatbot
CVE-2024-12415	Jan 31, 2025	AI Infographic Maker <=4.9.0 Unauth Arbitrary Shortcode Exec The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2024-12879	Jan 22, 2025	WPBot Pro 13.5.5 Chatbot: Missing Capability Check; Subscriber Modification The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.	Wpot Wpbot
CVE-2024-13091	Jan 22, 2025	Arbitrary File Upload in WPBot Pro <=13.5.4 (WordPress Plugin) The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qcld_wpcfb_file_upload' function in all versions up to, and including, 13.5.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The exploit requires thee ChatBot Conversational Forms plugin and the Conversational Form Builder Pro addon plugin.	Wpbot
CVE-2024-56297	Jan 07, 2025	dn88 Highlight <=2.0.2 Stored XSS (CVE-2024-56297) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Highlight highlight allows Stored XSS.This issue affects Highlight: from n/a through <= 2.0.2.	Highlight
CVE-2024-56238	Jan 02, 2025	Missing Auth (ACL) in QunatumCloud Floating Action Buttons v0.9.1 Missing Authorization vulnerability in QuantumCloud Floating Action Buttons floating-action-buttons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Floating Action Buttons: from n/a through <= 0.9.1.	Floating Action Buttons
CVE-2024-12417	Dec 13, 2024	WordPress Simple Link Directory Plugin: Arbitrary Shortcode Execution Vulnerability The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.	Simple Link Directory
CVE-2024-12156	Dec 12, 2024	WordPress Plugin AI Content Writer XSS Vulnerability The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2024-11928	Dec 10, 2024	WordPress iChart Plugin Stored XSS Vulnerability in Width Parameter The iChart Easy Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-52395	Nov 19, 2024	QunatumCloud Floating Buttons for WooCommerce: Missing Authorization Vulnerability Missing Authorization vulnerability in QuantumCloud Floating Buttons for WooCommerce shop-assistant-for-woocommerce-jarvis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Floating Buttons for WooCommerce: from n/a through <= 2.8.8.	Floating Buttons
CVE-2024-6669	Jul 17, 2024	WPBot<5.5.7 XSS via Admin Settings, Authenticated WP WordPress Plugin The AI ChatBot for WordPress WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	Ai Chatbot Wpbot
CVE-2024-5811	Jul 12, 2024	Stored XSS via Unsanitized Settings in Simple Video Directory WP Plugin <1.4.4 The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	Simple Video Directory
CVE-2024-5858	Jun 15, 2024	AI Infographic Maker <=4.7.4 Missing cap check in qcld_aotgd The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles.
CVE-2024-0451	May 22, 2024	WordPress AI ChatBot 5.3.4 Auth ZBA: openai_file_list_callback flaw The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.	Wpbot
CVE-2024-0452	May 22, 2024	AI ChatBot WP Plugin <=5.3.4: Missing Cap Check Enables Auth Upload to OpenAI The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.	Wpbot
CVE-2024-0453	May 22, 2024	Unauthorized File Delete in AI ChatBot WP Plugin v5.3.4 The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.	Wpbot
CVE-2024-29922	Mar 27, 2024	Quantum Cloud Slider Hero Stored XSS (<=8.6.1) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quantum Cloud Slider Hero allows Stored XSS.This issue affects Slider Hero: from n/a through 8.6.1.	Slider Hero