Stored Cross-Site Scripting in AI ChatBot for WordPress Plugin by WordPress
CVE-2025-9111
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-9111?
The AI ChatBot for WordPress plugin, prior to version 7.1.0, has a significant security flaw where it fails to adequately sanitize and escape certain settings. This vulnerability can be exploited by users with high privileges, like administrators, enabling them to execute Stored Cross-Site Scripting (XSS) attacks. Importantly, this issue persists even in environments where the unfiltered_html capability is disabled, such as on multisite installations.
Affected Version(s)
AI ChatBot for WordPress 0 < 7.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.