CVE-2026-13005: MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting
The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13005?
The severity of CVE-2026-13005 is classified as medium with a score of 4.4.
What type of vulnerability is CVE-2026-13005?
CVE-2026-13005 is an authenticated stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-13005?
To fix CVE-2026-13005, update the MxChat plugin to version 3.2.11 or later.
Who can exploit CVE-2026-13005?
CVE-2026-13005 can be exploited by authenticated users with admin privileges.
What software is affected by CVE-2026-13005?
The CVE-2026-13005 vulnerability affects all versions of the MxChat – AI Chatbot & Content Generation for WordPress plugin up to and including 3.2.10.