CVE-2026-13005

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php#L145
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php#L522
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/admin/class-ajax-handler.php#L528
• https://plugins.trac.wordpress.org/browser/mxchat-basic/tags/3.2.10/includes/class-mxchat-admin.php#L7811
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3590075%40mxchat-basic&new=3590075%40mxchat-basic
• https://www.wordfence.com/threat-intel/vulnerabilities/id/120bc64f-05ec-41e7-9ed4-d88014f4a3ea?source=cve

Published

Jul 16, 2026

Last Modified

Jul 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12993A flaw was found in Apicurio Registry. The DocumentBuilderAc…6.5
• CVE-2026-12994The WCFM – Frontend Manager for WooCommerce plugin for WordP…5.3
• CVE-2026-12996A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alp…8.1
• CVE-2026-12997The Gravity Forms plugin for WordPress is vulnerable to Dire…7.5
• CVE-2026-1300The Responsive Header plugin for WordPress is vulnerable to …4.4
• CVE-2026-13001The Podlove Podcast Publisher plugin for WordPress is vulner…9.8
• CVE-2026-13006ACE vulnerability in conditional configuration file processi…7
• CVE-2026-13007Tenable Identity Exposure contains multiple unauthenticated …8.7
• CVE-2026-13008Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-13009The AI Copilot – Content Generator plugin for WordPress is v…6.5
• CVE-2026-1301In builds with PubSub and JSON enabled, a crafted JSON messa…6.8
• CVE-2026-13010The JoomSport – for Sports: Team & League, Football, Hockey …6.5