MxChat: Stored DOM-Based Cross-Site Scripting (CVE-2026-110662)

The MxChat - AI Chatbot & Content Generation for WordPress plugin is vulnerable to stored DOM-based Cross-Site Scripting (XSS) in versions up to and including 3.2.25. The flaw exists due to insufficient sanitization and output escaping of the 'feedback' parameter. An unauthenticated attacker can submit a malicious script via a POST request to the plugin's endpoint, which is then stored and executed when an administrator views the plugin's Transcripts page.

Attack Chain

1. Attacker crafts a malicious payload containing arbitrary JavaScript.
2. Attacker sends an unauthenticated HTTP POST request to the 'admin-ajax.php' endpoint.
3. The plugin accepts and stores the payload within the 'feedback' parameter.
4. An administrator navigates to the Transcripts page within the WordPress dashboard.
5. The plugin renders the stored payload in the administrator's browser.
6. Malicious script executes in the context of the administrator's session.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a logged-in administrator, potentially leading to unauthorized administrative actions, session hijacking, or site-wide configuration changes.

Recommendation

• Upgrade the MxChat - AI Chatbot & Content Generation for WordPress plugin to a version beyond 3.2.25 immediately.
• If an update is unavailable, disable the plugin until a patch is applied.
• Audit the 'Transcripts' page for unexpected or suspicious content, such as script tags or unconventional data within the feedback logs.