MxChat EUVD-2026-111736

Requires only that the MxChat - AI Chatbot & Content Generation plugin (≤ 3.2.25) be installed and active; an unauthenticated visitor can store the payload via a single POST to admin-ajax.php using the 'feedback' parameter, with no authentication, user account, or non-default configuration needed for injection. The key limiting factor is detonation: the stored script executes only when an administrator subsequently loads the plugin's Transcripts page in wp-admin, so impact depends on an admin viewing that specific admin screen while the malicious record is present.

This is a legitimate but moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change, which is what pushes a low/low impact XSS into the 'High' band. The vuln.today decision label is 'this_week' - meaning it warrants prompt patching but is not flagged as an emergency. No EPSS score was supplied in the input, and the vulnerability is NOT in CISA KEV, so there is no confirmed-active-exploitation signal; exploitation status is 'no public exploit identified at time of analysis' (the trac/changeset links are source code and fix references, not working exploit code). Note a tension between the metrics and the described mechanism: the vector is UI:N, yet the description states the payload 'detonates automatically when any administrator next loads the Transcripts page' - detonation is therefore gated on an administrator performing a normal in-dashboard action, which materially limits real-world reliability even though the injection itself is unauthenticated. The confidentiality/integrity impact is rated Low because execution occurs in the admin's browser context (session/DOM), not full server compromise. Net: a real issue to patch this week, not a drop-everything event, with the practical risk hinging on whether/when an admin views the Transcripts page.

An unauthenticated visitor sends a single crafted POST to wp-admin/admin-ajax.php supplying a malicious 'feedback' value, which is stored without sufficient sanitization. The next time any administrator opens the plugin's Transcripts page in wp-admin, the stored payload is rendered into the DOM and executes in the administrator's authenticated browser session. No public working exploit code is identified at time of analysis, though the vulnerable JS/PHP source and the fixing changeset are publicly referenced.