Stored DOM-Based Cross-Site Scripting in AI Marketing Expert Plugin for WordPress

CVE-2026-109999

What is CVE-2026-109999?

The AI Marketing Expert plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to exploit Stored DOM-Based Cross-Site Scripting via the 'name' parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 1.2.8. If exploited, an attacker can inject arbitrary web scripts that execute when any user accesses an affected page. To trigger this vulnerability, the chatbot module must be active with at least one configured bot, allowing the attacker to store malicious payloads through unauthenticated REST calls. This vulnerable configuration facilitates the delivery of malicious scripts to any administrator who logs into the wp-admin dashboard.

References