The vulnerability is an unauthenticated Cross Site Scripting flaw that exists in WordPress AI Engine plugin versions up to 3.6.8. The flaw allows an attacker to inject arbitrary scripts into pages that are viewed by users, potentially leading to credential theft, session hijacking, defacement, or malware delivery. The weakness is classified as CWE‑79 and is rated with a CVSS score of 7.1, indicating a high severity.

The defect affects the AI Engine plugin developed by Jordy Meow. All installations of the plugin with a version number 3.6.8 or earlier are susceptible. WordPress sites that have not applied the latest plugin update are at risk.

The CVSS score of 7.1 reflects significant risk, while the EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, suggesting no public exploits are confirmed at this time. Because the flaw is unauthenticated and leverages XSS, an attacker only needs to convince a legitimate user to visit a crafted page, making the threat easy to exploit if a vulnerable site is found on the internet. The lack of an authentication requirement and the widespread use of WordPress make the potential impact global if no corrective action is taken.