---
id: "CVE-2026-123478"
page: "https://infrastack.ai/live/CVE-2026-123478"
kind: "vulnerability"
aliases: ["CVE-2026-123478"]
title: "AI Engine WordPress plugin: stored XSS through 3.9.1"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ai-engine", "fixed": [], "affected": "<= 3.9.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ai-engine", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T11:17:16+00:00"
first_seen_at: "2026-11-11T11:26:56+00:00"
updated_at: "2026-11-11T11:29:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123478", "first_seen_at": "2026-11-11T11:26:56+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123478", "first_seen_at": "2026-11-11T11:29:25+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-123478", "https://wordpress.org/plugins/ai-engine/"]}]
exploit_sources: []
---

# AI Engine WordPress plugin: stored XSS through 3.9.1

Link for people: https://infrastack.ai/live/CVE-2026-123478 (this .md is for agents)

AI Engine, a WordPress plugin by Meow Apps, has a stored cross-site scripting flaw in versions through 3.9.1. An attacker who can get script into stored content can run it in other users' browsers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ai-engine affected <= 3.9.1 fixed no fixed version listed

## How to check

- WordPress admin > Plugins: read the AI Engine version. 3.9.1 or lower is in the affected range per the CVE description.
- Or run: wp plugin get ai-engine --field=version
- Also check AI Engine Pro (ai-engine-pro) if you use it; no source confirms it is affected.

## Fix

No source names the fixed version for this CVE. The wordpress.org page lists 3.9.3 as current (Nov 10, 2026); its 3.9.2 entry (Nov 6) hardens uploads against disguised HTML, reported via Patchstack, but does not cite this CVE. Update to the latest release (3.9.3 or later) as the practical step.

## Timeline

- 2026-11-11T11:26:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123478
- 2026-11-11T11:29:25+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-123478 — NVD page is empty of detail; no Meow Apps/Patchstack/WPScan advisory found for this id (search returned only sibling CVEs). Fix version unconfirmed; 3.9.3 is current per wordpress.org changelog. Nothing verified. Search tools worked; X not checked.

## Documents

- [describes] NVD CVE-2026-123478 https://nvd.nist.gov/vuln/detail/CVE-2026-123478
- [mentions] AI Engine plugin page and changelog (wordpress.org) https://wordpress.org/plugins/ai-engine/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_