Stored DOM-Based Cross-Site Scripting Vulnerability in MxChat Plugin for WordPress

CVE-2026-110662

What is CVE-2026-110662?

The MxChat – AI Chatbot & Content Generation plugin for WordPress contains a vulnerability that allows for Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter. This issue arises from inadequate input sanitization and output escaping practices. Unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into pages that execute when an administrator accesses the Transcripts page. The malicious payload can be inserted through a simple POST request to the admin-ajax.php endpoint, posing a significant risk to site integrity, especially when accessed by privileged users.

References