Cross-Site Scripting Vulnerability in ThemeIsle AI Chatbot for WordPress - Hyve Lite
CVE-2025-24666

5.9MEDIUM

Key Information:

Vendor

Wordpress
Status
Ai Chatbot For WordPress – Hyve Lite
Vendor
CVE Published:
24 January 2025

What is CVE-2025-24666?

The AI Chatbot for WordPress - Hyve Lite has a vulnerability that permits attackers to conduct cross-site scripting (XSS) attacks due to improper neutralization of user input during web page generation. This flaw allows malicious scripts to be executed within the affected application, potentially compromising user data and site security. Users are advised to update their plugins to the latest version and implement additional security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

AI Chatbot for WordPress – Hyve Lite <= 1.2.2

References

https://patchstack.com/database/wordpress/plugin/hyve-lit...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Caesar Evan Santoso (Patchstack Alliance)
.
CVE-2025-24666 : Cross-Site Scripting Vulnerability in ThemeIsle AI Chatbot for WordPress - Hyve Lite