A stored DOM‑based XSS flaw in the MxChat WordPress plugin allows an unauthenticated user to inject arbitrary scripts via the "feedback" parameter. The injected payload is saved and executed whenever an administrator opens the Transcripts page, exposing the attack to any privileged user on the site and enabling code execution, credential theft, or defacement. This weakness is classified as CWE‑79.

All WordPress installations running MxChat version 3.2.25 or earlier are vulnerable. The flaw exists within the plugin’s administration code and associated JavaScript that handles transcript data in the Transcripts page.

The vulnerability carries a CVSS score of 7.2, indicating high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog; however, the absence from KEV does not preclude exploitation. The attack can be performed by any unauthenticated visitor who sends a single POST request to admin‑ajax.php containing a malicious "feedback" value. Once stored, the payload detonates automatically when a privileged user loads the Transcripts page, offering a remote attack vector that does not require authentication to deliver the malicious content.