WordPress plugin AI BotKit – AI Chatbot & Live Support for WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress AI BotKit plugin <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by theviper17y in WordPress Plugin AI BotKit versions = 1.1.7...

@fedify/botkit (>=0.4.0-dev.167, <=0.4.0-dev.173), @fedify/botkit-sqlite (>=0.4.0-dev.167, <=0.4.0-dev.173) potentially affected by CVE-2025-68475 via @fedify/fedify (1.9.0-dev.1516)

@fedify/fedify NPM version 1.9.0-dev.1516 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.167, =0.4.0-dev.167, =0.4.0-dev.173 Source cves: CVE-2025-68475 Source advisory:...

@fedify/botkit (>=0.4.0-dev.167, <=0.4.0-dev.173), @fedify/botkit-sqlite (>=0.4.0-dev.167, <=0.4.0-dev.173) potentially affected by CVE-2025-68475 via @fedify/fedify (1.9.0-dev.1516)

@fedify/fedify NPM version 1.9.0-dev.1516 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.167, =0.4.0-dev.167, =0.4.0-dev.173 Source cves: CVE-2025-68475 Source advisory:...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-68475 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-68475 Source advisory: OSV:GHSA-RCHF-XWX2-HM93...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-68475 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-68475 Source advisory: SNYK:JS-FEDIFYFEDIFY-14552161...

Malicious code in botkit-storage-mongo-updated (npm)

The package botkit-storage-mongo-updated was found to contain malicious code...

MAL-2025-16010 Malicious code in botkit-storage-mongo-updated (npm)

The package botkit-storage-mongo-updated was found to contain malicious code...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-54888 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-54888 Source advisory: SNYK:JS-FEDIFYFEDIFY-11735306...

@fedify/botkit (>=0.3.0-dev.125, <=0.3.0-dev.131) potentially affected by CVE-2025-54888 via @fedify/fedify (1.8.1-dev.1262)

@fedify/fedify NPM version 1.8.1-dev.1262 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.3.0-dev.125, =0.3.0-dev.131 Source cves: CVE-2025-54888 Source advisory: OSV:GHSA-6JCC-XGCR-Q3H4...

MAL-2025-2417 Malicious code in spark-botkit-servicenow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db9e7b07208198145174b016dd7c98f443f46d0605e07e3f8a84f24f58efd4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spark-botkit-servicenow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db9e7b07208198145174b016dd7c98f443f46d0605e07e3f8a84f24f58efd4ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

botbuilder (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0), botbuilder-azure (>=4.10.0-dev.20200805.aa06ea2, <=4.10.2-rc0) +2 more potentially affected by CVE-2021-1725 via botframework-connector (>=4.10.0, <=4.10.2-rc0)

botframework-connector NPM version =4.10.0, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.0-dev.20200805.aa06ea2, =4.10.2-rc0-preview - botkit-mock 4.10.0 Source cves: CVE-2021-1725 Source advisory: OSV:GHSA-FVCJ-HVFW-7F2V...

Man-in-the-Middle (MitM)

botkit is vulnerable to man-in-the-middle MitM attacks. The library does not implement an app secret proof parameter when connecting to the Facebook API, allowing a malicious user who has a stolen app token to send messages from the chat bot's behalf...

Distributed Denial Of Service (DDoS)

botkit is vulnerable to distributed denial of service DDoS attacks. These attacks are possible because it does not validate the X-HUB signature sent in the headers against the facebook app secret. This allows attackers to send arrays with a large amount of data in them to botkit and lock the...