CVE-2026-110662

MxChat visitor feedback can execute scripts in the transcripts view

MxChat · MxChat WordPress AI chatbot

First documented disclosure · Review checkpoint

Summary

Unauthenticated feedback can reach an administrator’s browser as executable script.

Severity and exploitation evidence

High · 7.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a confirmed victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Stored feedback is inserted into the transcripts DOM without adequate sanitization or escaping.

Conditions required

Public access to the rating submission endpoint; an administrator later opens Transcripts.

Potential impact

Script execution in the administrator browser context.

Affected versions and configurations

All versions through 3.2.25.

Fix and mitigation status

3.2.26.

Practical next steps

Upgrade to a current patched release and review suspicious feedback before reopening affected administrative views.

Operating lesson

Render chat feedback as data even in trusted administrative interfaces.

Evidence and limits

The October 17 release notes explicitly cover visitor-feedback display hardening. Detailed disclosure was October 27 and CNA publication October 28. The source’s UI:N vector is retained alongside its administrator-view prerequisite.

Sources