Cpe:2.3:a:mxchat:mxchat_-_Ai_chatbot_&_content_generation_for_wordpress:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amxchatmxchat_-_ai_chatbot__content_generation_for_wordpresswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:27:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMxChat: Stored DOM-Based Cross-Site Scripting (CVE-2026-110662)https://feed.craftedsignal.io/briefs/2026-10-mxchat-xss/Wed, 28 Oct 2026 08:27:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mxchat-xss/The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.The MxChat - AI Chatbot & Content Generation for WordPress plugin is vulnerable to stored DOM-based Cross-Site Scripting (XSS) in versions up to and including 3.2.25. The flaw exists due to insufficient sanitization and output escaping of the 'feedback' parameter. An unauthenticated attacker can submit a malicious script via a POST request to the plugin's endpoint, which is then stored and executed when an administrator views the plugin's Transcripts page.

Attack Chain

  1. Attacker crafts a malicious payload containing arbitrary JavaScript.
  2. Attacker sends an unauthenticated HTTP POST request to the 'admin-ajax.php' endpoint.
  3. The plugin accepts and stores the payload within the 'feedback' parameter.
  4. An administrator navigates to the Transcripts page within the WordPress dashboard.
  5. The plugin renders the stored payload in the administrator's browser.
  6. Malicious script executes in the context of the administrator's session.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a logged-in administrator, potentially leading to unauthorized administrative actions, session hijacking, or site-wide configuration changes.

Recommendation

  • Upgrade the MxChat - AI Chatbot & Content Generation for WordPress plugin to a version beyond 3.2.25 immediately.
  • If an update is unavailable, disable the plugin until a patch is applied.
  • Audit the 'Transcripts' page for unexpected or suspicious content, such as script tags or unconventional data within the feedback logs.
]]>highadvisoryxssweb-vulnerabilitywordpress