CVE-2026-123478

Stored content in AI Engine could run script in a visitor's browser

Meow Apps · AI Engine WordPress plugin

First documented disclosure · Review checkpoint

Summary

The plugin rendered stored input without sufficient output escaping. Script could run in that visitor’s browser under the site’s origin.

Severity and exploitation evidence

High · 7.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The plugin rendered stored input without sufficient output escaping.

Conditions required

An unauthenticated contributor could supply the input. A user subsequently viewed the affected page.

Potential impact

Script could run in that visitor’s browser under the site’s origin.

Affected versions and configurations

Through 3.9.1.

Fix and mitigation status

3.9.2.

Practical next steps

Update the AI Engine plugin to 3.9.2 or later.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The public disclosure was on 2026-11-09. The CVE record was published on 2026-11-11.

Sources