Executive brief
MxChat is a WordPress plugin used to integrate AI chatbots and content generation into websites. A security vulnerability allows administrators to save malicious scripts into the plugin's settings, which then execute when other users visit the site. This issue primarily impacts WordPress multi-site environments or specific configurations where standard security restrictions on HTML content have been relaxed.
Technical details
The MxChat plugin for WordPress (versions up to 3.2.10) contains a stored cross-site scripting (XSS) vulnerability within its administrative settings. The root cause is a failure to properly sanitize user input and escape output in the admin-facing configuration pages. An authenticated attacker with administrator-level privileges can inject arbitrary JavaScript into the database. This script executes in the context of any user accessing the affected pages. The vulnerability is specifically relevant in WordPress multi-site installations or single-site setups where the 'unfiltered_html' capability has been disabled for administrators, as it allows them to bypass intended security restrictions.
Affected products
- MxChat MxChat – AI Chatbot & Content Generation for WordPress Up to and including 3.2.10
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php
- https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php
- https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php
- https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/includes/class-mxchat-admin.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3590075%40mxchat-basic&new=3590075%40mxchat-basic
- https://www.wordfence.com/threat-intel/vulnerabilities/id/120bc64f-05ec-41e7-9ed4-d88014f4a3ea?source=cve