CVE-2026-123478: WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress AI Engine pluginto a version that resolves this vulnerability.Fixed in 3.9.2
Event History
Frequently Asked Questions
Which AI Engine versions are affected?
AI Engine versions through 3.9.1 are affected. The available data does not identify a fixed version.
What kind of impact can exploitation have?
This is a stored cross-site scripting vulnerability. The supplied severity vector indicates network-reachable exploitation with low complexity, no required privileges, user interaction required, and potential low impact to confidentiality, integrity, and availability across a changed scope.
Can this be exploited without a user viewing attacker-controlled content?
No. The CVSS vector includes UI:R, indicating user interaction is required for exploitation.