CVE-2025-5570: Meowapps AI Engine XSS Vulnerability

CVE-2025-5570 Overview

CVE-2025-5570 is a Stored Cross-Site Scripting (XSS) vulnerability in the AI Engine plugin for WordPress developed by Meowapps. The flaw affects all versions of the plugin up to and including 2.8.4. The vulnerability resides in the mwai_chatbot shortcode's id parameter, which lacks sufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts that execute when other users view affected pages. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated Subscriber-level users can inject persistent JavaScript that executes in the browser context of any visitor, enabling session theft, account takeover, and administrative privilege escalation.

Affected Products

Meowapps AI Engine plugin for WordPress, all versions through 2.8.4
WordPress sites running the plugin with Subscriber-level registration enabled
Any page or post rendering the mwai_chatbot shortcode with untrusted input

Discovery Timeline

2025-07-08 - CVE-2025-5570 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5570

Vulnerability Analysis

The AI Engine plugin exposes a mwai_chatbot shortcode that renders an interactive chatbot interface within WordPress pages and posts. The shortcode accepts an id parameter that identifies the chatbot instance to load. The plugin handler processes this parameter and reflects it into the rendered HTML output without applying proper sanitization or output escaping.

Because WordPress Subscriber accounts can be created through open user registration on many sites, the attack surface extends to low-privilege authenticated users. Once injected, the malicious payload persists in the database and executes for every visitor who loads the affected page. This creates a persistent client-side attack primitive suitable for stealing authentication cookies, hijacking administrator sessions, and pivoting to full site compromise.

Root Cause

The root cause is missing input validation and output escaping in the mwai_chatbot shortcode handler located in classes/modules/chatbot.php. The id attribute passed via the shortcode is not filtered through WordPress escaping functions such as esc_attr() or esc_html() before being emitted into the response HTML. This violates the standard WordPress security model for shortcode attribute handling.

Attack Vector

The attack requires network access and authenticated privileges at Subscriber level or above. An attacker with such access embeds a mwai_chatbot shortcode containing a crafted id value that includes an HTML-breaking payload with JavaScript. The payload is stored in the post or page content. When any user, including administrators, subsequently views the page, the browser parses and executes the injected script under the site's origin.

For technical implementation details, see the WordPress AI Engine Chatbot Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5570

Indicators of Compromise

Posts or pages containing mwai_chatbot shortcodes with unusual id attribute values containing quotes, angle brackets, script, onerror, onload, or javascript: strings
New or modified WordPress content authored by Subscriber-level accounts
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that render the AI Engine chatbot
Administrator session cookies or nonces appearing in web server logs as query string parameters to external hosts

Detection Strategies

Audit the wp_posts table for shortcode entries matching the pattern mwai_chatbot with attribute values containing HTML metacharacters
Enable web application firewall rules that inspect shortcode attributes for XSS payloads before content is saved
Review recent user registrations and correlate new Subscriber accounts with post or page modifications

Monitoring Recommendations

Monitor WordPress audit logs for content edits performed by low-privilege accounts
Alert on Content Security Policy (CSP) violation reports referencing inline script execution on pages rendering the AI Engine chatbot
Track browser console errors and network telemetry from administrator sessions for unexpected script origins

How to Mitigate CVE-2025-5570

Immediate Actions Required

Update the AI Engine plugin to a version later than 2.8.4 as soon as the vendor releases a patched build
Temporarily disable the AI Engine plugin if an updated version is not yet available and the chatbot functionality is not business-critical
Review and remove any suspicious mwai_chatbot shortcodes injected by non-trusted users
Rotate administrator passwords and invalidate active sessions if injection is confirmed

Patch Information

At the time of publication, refer to the Wordfence Vulnerability Report for the current fixed version. All versions up to and including 2.8.4 are affected. Site operators should upgrade to the vendor-supplied patched release and verify the shortcode handler applies esc_attr() to the id parameter.

Workarounds

Disable open user registration or restrict the default role from Subscriber to a role without content creation capability
Deploy a web application firewall rule that blocks mwai_chatbot shortcodes containing HTML special characters in the id attribute
Apply a strict Content Security Policy that disallows inline scripts to limit the impact of injected payloads
Restrict shortcode usage using WordPress capability filters until the plugin is patched

bash

# Disable open registration and force safe default role via wp-config.php and options
wp option update users_can_register 0
wp option update default_role 'subscriber'

# Search database for suspicious mwai_chatbot shortcodes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP 'mwai_chatbot[^]]*id=\"[^\"]*[<>\"\']';"

# Deactivate the vulnerable plugin until patched
wp plugin deactivate ai-engine