{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mxchat--ai-chatbot--content-generation-for-wordpress--3.2.25/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mxchat:mxchat_-_ai_chatbot_\u0026_content_generation_for_wordpress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-110662"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MxChat – AI Chatbot \u0026 Content Generation for WordPress (\u003c= 3.2.25)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","wordpress"],"_cs_type":"advisory","_cs_vendors":["MxChat"],"content_html":"\u003cp\u003eThe MxChat - AI Chatbot \u0026amp; Content Generation for WordPress plugin is vulnerable to stored DOM-based Cross-Site Scripting (XSS) in versions up to and including 3.2.25. The flaw exists due to insufficient sanitization and output escaping of the 'feedback' parameter. An unauthenticated attacker can submit a malicious script via a POST request to the plugin's endpoint, which is then stored and executed when an administrator views the plugin's Transcripts page.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing arbitrary JavaScript.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP POST request to the 'admin-ajax.php' endpoint.\u003c/li\u003e\n\u003cli\u003eThe plugin accepts and stores the payload within the 'feedback' parameter.\u003c/li\u003e\n\u003cli\u003eAn administrator navigates to the Transcripts page within the WordPress dashboard.\u003c/li\u003e\n\u003cli\u003eThe plugin renders the stored payload in the administrator's browser.\u003c/li\u003e\n\u003cli\u003eMalicious script executes in the context of the administrator's session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser session of a logged-in administrator, potentially leading to unauthorized administrative actions, session hijacking, or site-wide configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the MxChat - AI Chatbot \u0026amp; Content Generation for WordPress plugin to a version beyond 3.2.25 immediately.\u003c/li\u003e\n\u003cli\u003eIf an update is unavailable, disable the plugin until a patch is applied.\u003c/li\u003e\n\u003cli\u003eAudit the 'Transcripts' page for unexpected or suspicious content, such as script tags or unconventional data within the feedback logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T08:27:24Z","date_published":"2026-10-28T08:27:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mxchat-xss/","summary":"The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.","title":"MxChat: Stored DOM-Based Cross-Site Scripting (CVE-2026-110662)","url":"https://feed.craftedsignal.io/briefs/2026-10-mxchat-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - MxChat – AI Chatbot \u0026 Content Generation for WordPress (\u003c= 3.2.25)","version":"https://jsonfeed.org/version/1.1"}