Stored XSS Vulnerability in AI Chatbot & Live Support Plugin for WordPress

CVE-2025-13887

What is CVE-2025-13887?

The AI BotKit – AI Chatbot & Live Support plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access and above to exploit stored Cross-Site Scripting (XSS). This flaw arises from inadequate input sanitization and output encoding in the 'id' parameter of the ai_botkit_widget shortcode. Attackers can inject arbitrary scripts into pages, which will then execute when a user accesses the compromised page, potentially leading to session hijacking, data theft, or site defacement.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References