What is the CVSS score of CVE-2026-65545?

CVE-2026-65545 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of AI Engine are affected by CVE-2026-65545?

The AI Engine WordPress plugin (versions ≤3.6.8) contains an unauthenticated cross-site scripting vulnerability allowing attackers to inject malicious code into user browsers and hijack authenticated…

How to fix or mitigate CVE-2026-65545?

Within 24 hours: Disable the AI Engine WordPress plugin on all affected installations; audit WordPress admin access logs for suspicious authentication attempts and session activity over the past 30 days. Within 7 days: Confirm with the plugin vendor whether a patched version or security update is available; if unavailable, evaluate replacement plugins and plan migration strategy. Implement Web Application Firewall (WAF) rules to detect and block XSS payloads if the plugin must remain temporarily active. Within 30 days: Migrate to a patched version of AI Engine or replace with a maintained alternative; force password resets for all WordPress administrator and user accounts; audit and strengthen Content Security Policy (CSP) headers across all WordPress installations to mitigate XSS execution.

AI Engine CVE-2026-65545

EUVD-2026-53975 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-m853-gvx3-8j6r

WordPress XSS Ai Engine Wordpress Plugin Jordy Meow

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with scope change warrants S:C, C:L, and I:L; availability reduced to N since XSS does not meaningfully disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:33 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

AnalysisAI

Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) reflects insufficient sanitization or output encoding of attacker-controlled data before rendering it in the browser as executable script. The affected component is the AI Engine WordPress plugin (CPE: cpe:2.3:a:jordy_meow:ai_engine:*:*:*:*:*:*:*:*) by Jordy Meow, which integrates AI-powered capabilities - including chatbot interfaces, content generation tools, and AI assistants - directly into WordPress sites via public-facing UI elements. The unauthenticated attack vector (PR:N per CVSS) indicates the injection point is accessible without any login, likely through a public form, chatbot input, or URL parameter rendered by the plugin. The scope change metric (S:C) is consistent with reflected or stored XSS where payload execution crosses into the browser security context of another user, most dangerously an authenticated administrator.

RemediationAI

Update the AI Engine WordPress plugin to a version beyond 3.6.8 using the WordPress plugin update mechanism or by manually downloading from the WordPress plugin repository. The exact patched release version is not independently confirmed in available intelligence - verify the current stable version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-6-3-cross-site-scripting-xss-vulnerability) before deploying. As a compensating control while patching is pending, consider disabling public-facing AI Engine features such as chatbot widgets or unauthenticated submission forms at the plugin settings level or via web server configuration to eliminate the unauthenticated injection surface; note this may disrupt intended AI-powered site functionality. A web application firewall with XSS signature rules can provide partial mitigation but should not substitute for patching, as WAF bypass for XSS is well-documented and reliable.