PT-2025-43508 · WordPress · Mxchat – Ai Chatbot For Wordpress

Published 2025-10-23 · Updated 2025-10-23 · CVE-2025-10705

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MxChat – AI Chatbot for WordPress plugin for WordPress versions up to and including 2.4.6

Description The software is susceptible to a Blind Server-Side Request Forgery due to inadequate validation of user-provided URLs within the PDF processing functionality. This allows unauthenticated attackers to compel the WordPress server to make HTTP requests to arbitrary destinations through the mxchat handle chat request AJAX action.

Recommendations Update to a version beyond 2.4.6.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10705

Affected Products

Mxchat – Ai Chatbot For Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10705 · Security Note
• https://twitter.com/VulmonFeeds/status/1981394795638493707 · Twitter Post
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1090 · Note
• https://plugins.trac.wordpress.org/changeset/3378505 · Note
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L2360 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c6ca63b8-b437-4e34-a57e-c3d956fbd102?source=cve · Note
• https://t.me/CVEtracker/35567 · Telegram Post
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1108 · Note
• https://twitter.com/CVEnew/status/1981359015893369007 · Twitter Post