CVE-2025-12078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12078", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-22T15:13:39.320Z", "datePublished": "2025-11-18T08:27:37.836Z", "dateUpdated": "2026-04-08T17:32:07.422Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:07.422Z"}, "affected": [{"vendor": "artibot", "product": "ArtiBot Free Chat Bot for WebSites", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efe48adb-af9f-45dc-b693-ae56dce1bfe2?source=cve"}, {"url": "https://wordpress.org/plugins/artibot/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nicolai Hellesnes"}], "timeline": [{"time": "2025-11-17T20:13:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:07:53.999123Z", "id": "CVE-2025-12078", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:08:01.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:07:53.999123Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:07:58.008Z"}}], "cna": {"title": "ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage", "credits": [{"lang": "en", "type": "finder", "value": "Nicolai Hellesnes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "artibot", "product": "ArtiBot Free Chat Bot for WebSites", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:13:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efe48adb-af9f-45dc-b693-ae56dce1bfe2?source=cve"}, {"url": "https://wordpress.org/plugins/artibot/"}], "descriptions": [{"lang": "en", "value": "The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:07.422Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12078", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:07.422Z", "dateReserved": "2025-10-22T15:13:39.320Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:37.836Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ArtiBot Free Chat Bot for WebSites", "vendor": "artibot", "versions": [{"lessThanOrEqual": "1.1.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin ArtiBot Free Chat Bot for WebSites para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s de PostMessage en todas las versiones hasta la 1.1.7, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-12078", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12078", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T21:07:53.999123Z", "version": "2.0.3"}}]}, "published": "2025-11-18T09:15:47.530", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/artibot/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efe48adb-af9f-45dc-b693-ae56dce1bfe2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:32:47.508250+00:00", "value": {"mitigation_remediation": ["Upgrade the ArtiBot plugin to the latest version (at least 1.1.8) which removes the vulnerable PostMessage handling.", "If an upgrade is not immediately possible, permanently disable or remove the plugin from the WordPress installation to eliminate the attack surface.", "Implement a web application firewall or security plugin that blocks reflected XSS payloads and enforces input sanitization for PostMessage events."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of the ArtiBot Free Chat Bot for WebSites plugin through version 1.1.7, including every WordPress site that has the plugin activated. Version information for the specific vulnerable releases is not provided in the advisory data, but the vulnerability applies to all releases up to and including 1.1.7.", "description_and_impact": "The ArtiBot Free Chat Bot for WebSites plugin for WordPress contains a reflected cross\u2011site scripting flaw that arises when untrusted input sent via the browser\u2019s PostMessage API is not properly escaped. An unauthenticated attacker can embed arbitrary JavaScript in a page that is rendered for the user when the victim is tricked into visiting a specially crafted link. If executed, the script runs with the victim\u2019s privileges and can steal session cookies, deface content, or perform other malicious actions on the site.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score, being less than 1%, suggests that the probability of exploitation at any given time is low, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is exploitable by unauthenticated users and relies solely on user interaction\u2014such as clicking a malicious link\u2014the attack vector is indirect, but once successful it can compromise confidentiality and integrity of the affected site. The lack of input validation and output escaping in the plugin\u2019s handling of PostMessage data is the root cause. "}}}}, "created": "2025-11-19T10:47:55.807279+00:00", "updated": "2026-04-21T01:45:24.436408+00:00", "vendors": ["artibot", "artibot$PRODUCT$artibot", "wordpress", "wordpress$PRODUCT$wordpress"]}