AI Engine WordPress Plugin Stored XSS via Prompt Injection

The AI Engine WordPress plugin is vulnerable to stored cross-site scripting through a chain of missing input validation and output escaping across multiple components. Unauthenticated attackers can inject arbitrary scripts that execute when administrators access the WordPress dashboard.

Disclosed 1 October 2026 · Record updated 1 October 2026

Impact

Unauthenticated attackers can inject arbitrary web scripts in the WordPress dashboard that execute when administrators access it, affecting versions up to 3.8.0.

Our coverage

A shadowy hand slips corrupted code through a cracked pipe into a glowing control room, bypassing all guards at the gate.

Vulnerabilities

WordPress AI plugin flaw lets attackers hijack admin dashboard

A chain of validation gaps in Meow Apps' AI Engine plugin lets unauthenticated attackers smuggle scripts into the dashboard through the PHP error log.

1 Oct 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-96561