MxChat – AI Chatbot & Content Generation for WordPress
MxChat – AI Chatbot & Content Generation for WordPress has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 5.0, and the most serious one scores 5.3 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Server-Side Request Forgery (SSRF).
Every one of the 3 issues recorded for MxChat – AI Chatbot & Content Generation for WordPress has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. MxChat – AI Chatbot & Content Generation for WordPress is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-12585MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Read the full analysisVulnerability Records

MxChat – AI Chatbot & Content Generation for WordPress
Author
MxChat
MxChat is the most powerful free AI chatbot and content generation plugin for WordPress — connecting your website to ChatGPT, Claude, Gemini, Grok, DeepSeek, and 100+ AI models through a single, easy-to-use interface. Train your AI chatbot on your website content, WooCommerce products, PDFs, YouTube videos, and more using advanced RAG (Retrieval-Augmented Generation) technology. Now with a built-in AI Content Generator to create full blog posts and landing pages complete with images, SEO metadata, and inline AI editing. Documentation | Demo Videos Why Choose MxChat as Your WordPress AI Chatbot? ✅ 6 Major AI Providers in One Plugin: OpenRouter, OpenAI GPT, Claude, Gemini, xAI Grok, and DeepSeek – switch between 100+ models instantly ✅ Train on Your Website Data: Advanced RAG technology learns from sitemaps, PDFs, URLs, YouTube videos, or manual input for ultra-relevant responses ✅ Live Agent Handoff via Slack: Seamlessly escalate from AI to human support when customers need personal assistance ✅ Real-Time Debug Panel: See exactly what your chatbot retrieves and triggers with our admin testing interface ✅ Boost Sales with WooCommerce: Product cards, cart management, and AI-powered shopping assistance ✅ AI Content Generator: Create full blog posts and landing pages with AI-generated images, SEO metadata, and real-time preview editing ✅ Extensive Add-On Ecosystem: Forms, moderation, recommendations, theme customization, and more 🎬 Quick Setup with MxChat – Learn how to quickly setup and understand how your chatbot works 📦 Optional Premium Add-Ons Extend the free plugin with these optional premium features: MCP Server Add-On – Turn your MxChat install into a Model Context Protocol server so Claude, ChatGPT, and Claude Code list transcripts, push knowledge, manage block-editor notes, generate images, and inspect bots natively — JSON-RPC 2.0 + OAuth + bearer auth, no per-message fees Advanced Content Editor Add-On – Smart internal linking, AI image management, readability analysis, Google Search Console integration, advanced SEO optimization, and 30-day AI Content Calendar for automated blog scheduling WooCommerce Add-On – AI-powered shopping assistance with product-aware conversations, native product cards with images and pricing, upselling and recommendations, order inquiry handling, cart management, and real-time inventory awareness Forms Add-On – Capture leads and data with custom in-chat forms MxChat Anywhere Add-On – Deploy your chatbot on any website with one script tag — Shopify, Squarespace, Wix, static HTML, and more AI Chatbot Theme Customizer Add-On – Instantly design chatbot themes with natural language using AI Multi-Bot Add-On – Run unlimited AI chatbots with custom knowledge and personalities Image Analysis Add-On – Enable AI-powered image analysis and OCR inside chats 👉 Visit our website to view all add-ons Core Features That Set MxChat Apart 🟢 100+ AI Models – Access ChatGPT, Claude, Gemini, Grok, DeepSeek, and 100+ models from OpenRouter with a single plugin 🟢 Lead Management Dashboard – Dedicated Leads tab inside Transcripts shows every captured email and name deduplicated by lead, with filters, bulk delete, CSV export, and one-click jump to each lead’s latest conversation 🟢 Chat Transcripts Dashboard – Review all conversations, see which knowledge sources the AI used and the tokens each reply cost, and give staff read-only access without making them administrators 🟢 WooCommerce Product Training – Train your AI chatbot on your entire product catalog including descriptions, pricing, SKUs, and categories for intelligent shopping assistance 🟢 Live Agent Handoff – Seamlessly escalate conversations from AI to human support via Slack when customers need personal assistance 🟢 ACF Field Control – Choose exactly which Advanced Custom Fields, including fields inside ACF Blocks, are included in your knowledge base—perfect for excluding private notes or internal data 🟢 Page Builder Content – Pages built with Breakdance, Oxygen, Bricks, Divi and WPBakery import their full text, and Auto-Sync keeps every page current with one embedding request per change 🟢 Always on a Working Model – When a provider discontinues a model, your chatbot moves to its current replacement automatically and tells you, so a retired model never breaks your chat 🟢 Advanced Action Recognition – Trigger Phrases use a smart vector embedding system to understand user intent and fire lead capture, appointments, redirects, and custom actions automatically — precise, deterministic control over when each action runs 🟢 AI Tools (Function Calling) – Let the chatbot decide on its own when to run an enabled action straight from natural language, with no phrases to set up. Use Trigger Phrases, AI Tools, or both together (function calling needs a tool-capable AI model) 🟢 Document Processing – Let visitors upload and chat with PDFs and Word documents directly on your frontend 🟢 Pinecone Vector Storage – Optional lightning-fast knowledge retrieval for large datasets and enterprise-scale deployments 🟢 Web Search Integration – Brave search provides real-time information beyond your knowledge base 🟢 AI Content Generator – Create full blog posts and landing pages from a prompt with AI images, SEO metadata, real-time preview, and inline AI editing via chat 🟢 Image Generation – OpenAI GPT Image and Google Nano Banana for visual content creation within chat conversations 🟢 Streaming Responses – Real-time response streaming for OpenAI, Claude, Grok, and DeepSeek models for the fastest possible chat experience 🟢 REST API – Bearer-token endpoints to read transcripts, push knowledge, and bulk-delete sessions — wire MxChat into n8n, Zapier, analytics dashboards, GDPR workflows, or your own agents Choose from 100+ Premium AI Models Access the world’s most advanced AI models based on your specific needs: OpenRouter: 100+ models from multiple providers with a single API key – including OpenAI, Anthropic, Google, Meta, Mistral, and more! OpenAI: GPT-6.1 Sol (recommended), GPT-6 Astra, GPT-6 Sol, GPT-6 Luna, GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna, GPT-5.5 Anthropic Claude: Claude Haiku 5.5 (recommended), Claude Sonnet 5.5, Claude Opus 5.5, Claude Fable 5.1, Claude Sonnet 5, Claude Opus 5, Claude Fable 5, Claude Opus 4.8, Claude Haiku 4.5 xAI Grok: Grok 4.20 Non-Reasoning (recommended), Grok 4.7, Grok 4.6, Grok 4.5, Grok 4.3, Grok 4.20 Reasoning Google Gemini: Gemini 3.8 Flash (recommended), Gemini 4 Argon, Gemini 3.1 Pro, Gemini 3.5 Flash-Lite DeepSeek: DeepSeek Flash (recommended), DeepSeek V4 Pro Custom: any OpenAI-compatible API, including local models through Ollama or LM Studio Each provider’s recommended model is its fast, affordable choice for customer chat. Sites already on an older model keep it. Lead Management Dashboard Every email and name your chatbot captures lands in one sortable list inside Transcripts: one row per lead with a conversation count and last-seen time, the pages that capture the most leads, search and date filters, orphan leads who filled in the pre-chat form but never chatted, a one-click jump to each lead’s conversation, and bulk delete or CSV export. It uses your existing chat data, with nothing to set up. AI Content Generator — Create Blog Posts & Landing Pages with AI MxChat includes a built-in AI Content Generator that lets you create full blog posts and landing pages directly from your WordPress dashboard — no external tools or copy-pasting required. How It Works: Describe Your Content — Enter a topic, title, or detailed prompt and choose between a blog post or landing page layout AI Generates Everything — The AI produces fully styled HTML with responsive CSS, ready-to-publish content, and optional AI-generated images using OpenAI GPT Image, Gemini, or Grok Real-Time Preview — See your content exactly as it will appear on your site with a live scaled preview, including desktop and mobile viewport switching Edit with AI Chat — Use the built-in AI chat panel to request changes like “make the heading bigger” or “change the background to blue” — the AI updates your content in real time Publish Instantly — Content is saved as a native WordPress post or page with clean HTML, SEO metadata, and responsive design that works with any theme Key Content Generator Features: Choose from multiple AI models for content generation (GPT-6, Claude, Gemini, Grok, and more) AI-generated images placed directly into your content with automatic media library uploads SEO title and meta description generation for search engine optimization Built-in SEO analysis with real-time scoring and one-click AI auto-optimization Fullwidth and standard layout options with automatic theme compatibility Content history to revisit and manage previously generated posts Works with popular page builders and themes including Elementor, Bricks, Divi, Astra, Kadence, and more Optional Advanced Content Editor Add-On for Google Search Console analytics, smart internal linking, readability analysis, and advanced SEO optimization MxChat Anywhere — Deploy Your Chatbot on Any Website Your WordPress site powers the AI, but your chatbot doesn’t have to live there. The MxChat Anywhere Add-On lets you deploy your fully configured chatbot on any website with a single script tag — Shopify, Squarespace, Wix, static HTML, SaaS apps, documentation sites, or anything with an HTML page. Key Features: One script tag to add your chatbot to any site — no coding or framework required Full style isolation via Shadow DOM so host page CSS never breaks your chatbot All your MxChat settings carry over automatically — colors, themes, quick questions, email collection, streaming, and more Multi-bot support lets you deploy different chatbot configurations on different sites Secure domain whitelisting and API key authentication prevent unauthorized usage Lightweight vanilla JS widget with zero dependencies — no jQuery needed on the target site Ideal for SaaS products with a WordPress blog but a separate web app, e-commerce brands on Shopify, documentation sites, or any business that needs their chatbot beyond WordPress. 📱 Mobile-Friendly & Fully Customizable MxChat’s chatbot widget adapts seamlessly to all devices — desktop, tablet, or mobile. Customize colors, greetings, and placement to match your brand and provide a smooth experience across your entire website. 🌟 What Makes MxChat the Best AI Chatbot for WordPress? Used by hundreds of WordPress websites worldwide 5-star average rating from satisfied customers Native WordPress integration – no external dependencies Setup in under 2 minutes with simple API key configuration 🆓 Start with MxChat’s Powerful Free Plan MxChat offers a fully functional free plan that includes everything you need to get started with AI chatbot and customer support. With no credit card required, you can: Access all AI models from 6 major providers AI Content Generator for blog posts and landing pages with SEO scoring and AI auto-optimization Train chatbot on unlimited website content Loops email capture for lead generation Web search and image generation capabilities Real-time admin debug panel Chat transcript review and export RAG support & contextual awareness Whether you’re running a small business or launching a new online store, MxChat’s free plan gives you the tools to offer intelligent customer support and grow your business — without paying a cent. Developer Hooks & Filters MxChat has filter hooks for developers who want to extend it without editing plugin files, including mxchat_should_index_post (return false to leave a post out of the knowledge base; it also receives import, auto_sync or reimport as the context), mxchat_before_process_post (change a post before it is indexed, or return false to skip it), mxchat_system_instructions (adjust the system prompt for each reply), mxchat_gemini_safety_settings (Gemini safety thresholds), mxchat_reference_shortcodes (shortcodes whose referenced content is imported), mxchat_index_use_rendered_page (return true or false to decide whether a post’s published page is read for its text), mxchat_filter_roles_rate_limit (reorder a logged-in user’s roles to choose which role’s rate limit applies; the first role in the list is used), mxchat_lead_retention_days (how many days a lead is kept after the visitor’s last chat; 0 keeps leads) and mxchat_stream_request (add headers to, or change the address or body of, a streamed chat request; WordPress’s own HTTP filters do not reach streamed replies). Add-ons can also call mxchat_generate_media_image() to create an image with the site’s image model and save it to the Media Library. Every hook is documented with code examples at mxchat.ai. External services To answer chats and generate content, MxChat sends requests with your own API key to the AI provider you choose: the visitor’s message, the recent conversation and the matching knowledge-base text. OpenAI – Terms | Privacy Anthropic – Terms | Privacy Google – Terms | Privacy xAI – Terms | Privacy DeepSeek – Terms | Privacy OpenRouter – Terms | Privacy Pro license management uses mxchat.ai, the plugin’s own website, and only on sites where a Pro license key has been entered. Activate License and Deactivate License send the key, the purchase email and the site’s domain when the administrator clicks them; the Pro & Extensions page checks whether the domain is linked; and once a day the site asks whether its domain is still switched on, also sending the plugin version. No visitor data or site content is sent, and a network error or outage never changes anything on the site. mxchat.ai – Terms | Privacy Credits This plugin incorporates the following third-party libraries: Smalot PDF Parser: Used for parsing and extracting text from PDF files. This library is developed by Smalot and distributed under the MIT License. For more details, visit the Smalot PDF Parser GitHub repository. QR Code Generator for JavaScript (qrcode-generator 1.4.4): Draws QR codes in the WordPress admin. Copyright (c) 2009 Kazuhiko Arase, distributed under the MIT License. See the qrcode-generator repository. This plugin was developed by MxChat.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C