Medium severity5.4NVD Advisory· Published Jul 8, 2025· Updated Jun 17, 2026

CVE-2025-5570

Description

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/AI Enginellm-fuzzy
Range: <=2.8.4
Package: https://wordpress.org/plugins/ai-engine
tigroumeow/AI Engine – The Chatbot, AI Framework & MCP for WordPressv5
Range: 0
WordPress/Enginewp-canonicalize

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/a32dcf96-ec75-46b1-8f1d-608411ad5147nvdThird Party Advisory
plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.2/classes/modules/chatbot.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000