CVE-2025-12585: MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12585?
CVE-2025-12585 has a high severity rating due to its potential for sensitive information exposure.
How do I fix CVE-2025-12585?
To fix CVE-2025-12585, update the MxChat – AI Chatbot for WordPress plugin to version 2.5.6 or later.
Who is affected by CVE-2025-12585?
All users of the MxChat – AI Chatbot for WordPress plugin up to and including version 2.5.5 are affected by CVE-2025-12585.
What kind of data is exposed by CVE-2025-12585?
CVE-2025-12585 exposes sensitive session values that can be exploited by unauthenticated attackers.
Is CVE-2025-12585 a local or remote vulnerability?
CVE-2025-12585 is considered a remote vulnerability as it can be exploited by attackers without authentication.