CSV Injection Vulnerability in AI Chatbot Free Models Plugin for WordPress
CVE-2025-11576
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2025
What is CVE-2025-11576?
The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is susceptible to CSV Injection due to inadequate sanitization within the 'newcodebyte_chatbot_export_messages' function. This vulnerability allows unauthenticated attackers to insert untrusted data into exported CSV files. When these files are opened in a local environment, especially if misconfigured, it can result in unauthorized code execution, posing a significant security risk for users.
Affected Version(s)
AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant * <= 1.6.5