CVE-2026-96561: AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKitMWAIHelpers::phperrorlogs), the Advisor task (MeowMWAIModulesAdvisor::runadvisor), and the Advisor dashboard widget (advisormetabox): the server-parameter denylist in chatsubmit strips only exact key names such as 'model' while convertkeys() later canonicalizes 'model' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; finalchecks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; runadvisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwaiadvisordata option with no schema validation or HTML sanitization, and advisormetabox() concatenates the resulting 'title' and 'description' values directly into the WordPress dashboard widget without eschtml(), wpkses(), or equivalent escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the WordPress dashboard.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using the Meow Apps AI Engine plugin in versions up to and including 3.8.0 are affected.
Does exploitation require an authenticated WordPress account or user interaction?
No. The vulnerable /mwai-ui/v1/chats/submit REST endpoint can be reached by an unauthenticated caller, and the supplied vector has no user-interaction requirement.
What conditions are involved in the attack chain?
An attacker can use the model_ parameter to bypass an exact-name denylist and inject attacker-controlled content, including CR/LF, into the PHP error log. The plugin later parses recent PHP errors into the Advisor prompt and stores returned Advisor data without schema validation, where it can reach the Advisor dashboard widget.