Cross-site Scripting Vulnerability in Powerful Auto Chat by Felipe Peixoto
CVE-2025-22292

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Powerful Auto Chat
Vendor
CVE Published:
3 February 2025

What is CVE-2025-22292?

The Powerful Auto Chat plugin by Felipe Peixoto suffers from a Cross-site Scripting (XSS) vulnerability that allows attackers to execute arbitrary scripts in the context of the user's browser. This stored XSS vulnerability affects users of the plugin up to version 1.9.8, potentially enabling the injection of malicious scripts that can compromise user data and manipulate website functionality.

Affected Version(s)

Powerful Auto Chat <= 1.9.8

References

https://patchstack.com/database/wordpress/plugin/powers-t...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.