Stored Cross-Site Scripting Vulnerability in AI Engine Plugin for WordPress

CVE-2025-5570

What is CVE-2025-5570?

The AI Engine plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the mwai_chatbot shortcode's 'id' parameter. This issue arises due to inadequate input validation and output washing, enabling authenticated attackers with Subscriber-level access or higher to insert malicious scripts. These scripts can then execute when users view afflicted pages, posing a serious security risk to WordPress installations using affected versions of the plugin.

References