{"data":{"id":"2e616208-af0b-47ea-a409-22659f5c9384","title":"CVE-2026-96561: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site…","summary":"The AI Engine plugin for WordPress, up to and including 3.8.0, contains a stored cross-site scripting flaw. An unauthenticated attacker can send crafted input to the /mwai-ui/v1/chats/submit REST endpoint, which writes an attacker-controlled string into the PHP error log as a forged line. The plugin's Advisor feature then passes that content into an AI prompt and stores the result unescaped, so the injected script runs when an administrator opens the WordPress dashboard.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-96561","publishedAt":"2026-10-01T04:18:22.110Z","cveId":"CVE-2026-96561","cweIds":["CWE-79"],"cvssScore":"7.2","cvssSeverity":"high","severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedVendors":[],"affectedVendorsRaw":["AI Engine WordPress plugin"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AI Engine WordPress plugin stored cross-site scripting via chat REST endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00328,"epssCheckedAt":"2026-10-10T03:00:39.353Z","kevDateAdded":null,"advisoryAliases":["GHSA-h282-rvgq-85qj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:43:05.308Z","patchAvailable":null,"disclosureDate":"2026-10-01T04:18:22.110Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"]}}