CVE-2025-12585

MEDIUM

MxChat - AI Chatbot for WordPress <2.5.5 - Info Disclosure

Title source: llm
STIX 2.1

Description

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data.

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
mxchat/MxChat – AI Chatbot & Content Generation for WordPress < 2.5.5
mxchat/MxChat – AI Chatbot for WordPress < 2.5.5
Published Dec 03, 2025
Tracked Since Feb 18, 2026