CVE-2025-9111: 
WordPress vulnerability analysis and mitigation

The AI ChatBot for WordPress WordPress plugin before version 7.1.0 contains a stored Cross-Site Scripting (XSS) vulnerability that affects high-privilege users such as administrators. The vulnerability exists due to improper sanitization and escaping of certain settings, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability specifically affects the FAQ Query Settings in the FAQ Builder section of the plugin, where unsanitized input can be processed (WPScan).

When exploited, this vulnerability allows administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled. This is particularly significant in multisite WordPress installations where such restrictions are commonly implemented (NVD).

The vulnerability has been patched in version 7.1.0 of the AI ChatBot for WordPress plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).