{"schema":"threatline.record/2","record":{"id":"CVE-2026-96561","aliases":[],"summary":"AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection","details":"The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation or HTML sanitization, and advisor_metabox() concatenates the resulting 'title' and 'description' values directly into the WordPress dashboard widget without esc_html(), wp_kses(), or equivalent escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the WordPress dashboard.","categories":["Applications & CMS"],"product":"AI Engine – The Chatbot, AI Framework & MCP for WordPress","vendor":"tigroumeow","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96561","source_modified_at":"2026-10-01T14:18:02.665Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"AI Engine – The Chatbot, AI Framework & MCP for WordPress","vendor":"tigroumeow","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.8.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00328,"percentile":0.24728,"score_date":"2026-10-23"},"published_at":"2026-10-01T03:28:22.465Z","modified_at":"2026-10-01T14:18:02.665Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96561","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T14:18:02.665Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96561","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/910e51da-6ee2-45d5-837b-7fea80f79390?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L216"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L162"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/advisor.php#L156"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/common/helpers.php#L251"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L299"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/engines/core.php#L533"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/query/base.php#L360"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L597"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/rest.php#L464"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/chatbot.php#L122"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fai-engine%2Ftags%2F3.8.0&new_path=%2Fai-engine%2Ftags%2F3.8.1"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-01T14:17:52.566760Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T14:18:02.665Z","content_hash":"7a319769bf62d0443a14aebc22ae824f44ce8d3c966c97bb42bb96b596cf5111"}}