What happened
CVE-2026-123478 (improper neutralization, stored XSS) affects the Meow Apps 'AI Engine' WordPress plugin through 3.9.1, published 2026-11-11 via Patchstack/WordPress. It allows stored cross-site scripting (CVSS 7.1) generated through the plugin's AI-assisted content handling, so a crafted injection is persisted and executed in the browser of anyone viewing the affected content.
Why it matters
The plugin is an AI-content-generation component integrated into WordPress, so the injection crosses the AI/content boundary: content the model or plugin generates/sanitizes is not safely escaped on output, and a stored-XSS payload can execute under a privileged WordPress admin session, enabling account/role takeover in an AI-assisted publishing workflow.
Attack vector
A stored cross-site scripting (CWE-79) defect in the AI Engine plugin: attacker-controlled content produced or handled by the plugin is not properly neutralized on output, so a crafted injection is stored and executed in a victim's browser when the affected AI-generated content/page is rendered, potentially running in a privileged (admin) session.
Affected systems
AI Engine (Meow Apps) plugin for WordPress through 3.9.1.
Mitigation
Update AI Engine to a version after 3.9.1 (the patchstack/WordPress advisory); apply output escaping/neutralization for plugin-rendered AI content and a Web Application Firewall on the WP site.