Mxchat – Ai Chatbot & Content Generation For Wordpress

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:mxchat:mxchat_–_ai_chatbot_&_content_generation_for_wordpress:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorMxchat (84cb505a-0c71-5d50-8bd9-64e283a0c839)
ProductMxchat – Ai Chatbot & Content Generation For Wordpress (72982d8d-ab29-58bf-a0db-ffd31e69686d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-110662 vulnerable 2026-11-03 10:16:01.030036 MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
HIGH (7.2)
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page.
Published: 2026-10-28T06:45:06.494Z
Updated: 2026-10-29T01:41:54.592Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-13005 vulnerable 2026-07-29 00:23:32.741683 MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
MEDIUM (4.4)
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2026-07-16T02:30:54.787Z
Updated: 2026-07-16T15:11:45.717Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-12585 vulnerable 2026-06-08 07:04:30.469745 MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
MEDIUM (5.3)
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data.
Published: 2025-12-03T03:27:14.561Z
Updated: 2026-04-22T18:58:43.157Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-10705 vulnerable 2026-06-08 07:02:27.375042 MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery
MEDIUM (5.3)
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.
Published: 2025-10-23T12:32:32.992Z
Updated: 2026-04-08T17:21:17.803Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.