CVE-2025-11576

{"id": "CVE-2025-11576", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11576", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T12:48:17.739856Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "newcodebyte", "product": "AI Chatbot Free Models \u2013 Customer Support, Live Chat, Virtual Assistant", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.5"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-24T13:15:46.203", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3378450/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5064873b-e70a-4fe6-8c5c-ced6025aaa5f?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "The AI Chatbot Free Models \u2013 Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5. This is due to insufficient sanitization in the 'newcodebyte_chatbot_export_messages' function. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration."}, {"lang": "es", "value": "El plugin AI Chatbot Free Models - Customer Support, Live Chat, Virtual Assistant para WordPress es vulnerable a Inyecci\u00f3n CSV en todas las versiones hasta la 1.6.5, inclusive. Esto se debe a una sanitizaci\u00f3n insuficiente en la funci\u00f3n newcodebyte_chatbot_export_messages. Esto hace posible que atacantes no autenticados incrusten entradas no confiables en archivos CSV exportados, lo que puede resultar en ejecuci\u00f3n de c\u00f3digo cuando estos archivos se descargan y abren en un sistema local con una configuraci\u00f3n vulnerable."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security@wordfence.com"}