A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the \n\ (POST) parameter. Through this vulnerability an attacker is capable to execute malicious JavaScript code.