AI Engine WordPress plugin: Stored Cross-Site Scripting

Summary

The WordPress plugin AI Engine by Meow Apps, versions up to and including 3.9.1, contains a stored Cross-Site Scripting vulnerability. An attacker can inject malicious scripts that run in the browser of a visitor or administrator who views the affected content, which can lead to session hijacking or account compromise. Exploitation requires a privileged user to perform an action, such as clicking a malicious link, visiting a crafted page or submitting a form. Version 3.9.2 is reported to fix the issue.

Affected

• AI Engine WordPress plugin (slug ai-engine) versions from n/a through 3.9.1
• Patchstack rates the priority as medium with a CVSS 3.1 score of 7.1

Fixed in

• Version 3.9.2 or later (the vendor changelog for 3.9.2 lists an upload validation security fix; the mapping to this CVE is not confirmed by the vendor)
• Current release: 3.9.3

Workaround

• No vendor-published workaround found. Updating is the recommended fix.
• Until updated, restrict who can use chat and form uploads and limit access to the Public API.

Exploitation

• Not known to be exploited in the wild as of 11 Nov 2026.
• No public proof-of-concept found.
• CISA KEV status not checked.

Our recommendation

• Inventory WordPress sites with AI Engine installed and check the version.
• Update to version 3.9.2 or later (3.9.3 is current).
• If a site cannot be updated quickly, restrict uploads and Public API access and review recent chat and form uploads for HTML or script content.
• Confirm the fixed version and vector against the Patchstack advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for AI Engine <= 3.9.1 patchstack.com
• OffSeq Radar entry for CVE-2026-123478 radar.offseq.com
• AI Engine on WordPress.org (changelog) wordpress.org
• Meow Apps AI Engine product page meowapps.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:24.