CVE-2026-96561 | CVSS: 7.2 | 严重级别: HIGH
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes
参考链接:
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/engines/
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/
• https://plugins.trac.wordpress.org/browser/ai-engine/tags/3.8.0/classes/modules/
📌 数据来源: NVD 官方