CVE-2025-10705

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.

• CWE-918

• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1090
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L1108
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/2.4.1/includes/class-mxchat-integrator.php#L2360
• https://plugins.trac.wordpress.org/changeset/3378505/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ca63b8-b437-4e34-a57e-c3d956fbd102?source=cve

Published

Oct 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10699A vulnerability was reported in the Lenovo LeCloud client ap…6
• CVE-2025-1070CWE-434: Unrestricted Upload of File with Dangerous Type vul…8.1
• CVE-2025-10700The Ally – Web Accessibility & Usability plugin for WordPres…4.3
• CVE-2025-10701The Time Clock – A WordPress Employee & Volunteer Time Clock…6.4
• CVE-2025-10702Improper Control of Generation of Code ('Code Injection') vu…8.6
• CVE-2025-10703Improper Control of Generation of Code ('Code Injection') vu…8.6
• CVE-2025-10706The Classified Pro theme for WordPress is vulnerable to unau…8.8
• CVE-2025-10707A weakness has been identified in JeecgBoot up to 3.8.2. Aff…8.8
• CVE-2025-10708A security vulnerability has been detected in Four-Faith Wat…7.5
• CVE-2025-10709A vulnerability was detected in Four-Faith Water Conservancy…7.5
• CVE-2025-1071A stored cross-site scripting (XSS) vulnerability exists in …4.8
• CVE-2025-10710A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up…4.3