The ArtiBot Free Chat Bot for WebSites plugin for WordPress contains a reflected cross‑site scripting flaw that arises when untrusted input sent via the browser’s PostMessage API is not properly escaped. An unauthenticated attacker can embed arbitrary JavaScript in a page that is rendered for the user when the victim is tricked into visiting a specially crafted link. If executed, the script runs with the victim’s privileges and can steal session cookies, deface content, or perform other malicious actions on the site.

All installations of the ArtiBot Free Chat Bot for WebSites plugin through version 1.1.7, including every WordPress site that has the plugin activated. Version information for the specific vulnerable releases is not provided in the advisory data, but the vulnerability applies to all releases up to and including 1.1.7.

The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score, being less than 1%, suggests that the probability of exploitation at any given time is low, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is exploitable by unauthenticated users and relies solely on user interaction—such as clicking a malicious link—the attack vector is indirect, but once successful it can compromise confidentiality and integrity of the affected site. The lack of input validation and output escaping in the plugin’s handling of PostMessage data is the root cause.