AI Engine Vulnerability – Unauthenticated Stored Cross-Site Scripting – CVE-2024-0378 | WordPress Plugin Vulnerability Report

Plugin Name: AI Engine

Key Information:

  • Software Type: Plugin
  • Software Slug: ai-engine
  • Software Status: Active
  • Software Author: tigroumeow
  • Software Downloads: 1,820,267
  • Active Installs: 60,000
  • Last Updated: March 1, 2024
  • Patched Versions: 2.2.1
  • Affected Versions: <= 2.2.0

Vulnerability Details:

  • Name: AI Engine <= 2.2.0
  • Title: Unauthenticated Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE: CVE-2024-0378
  • CVSS Score: 6.5
  • Publicly Published: March 1, 2024
  • Researcher: rootxsudip
  • Description: The AI Engine plugin, renowned for enabling WordPress sites to leverage advanced AI features such as chatbots, content generators, and GPT-4 assistants, has been found vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 2.2.0. This vulnerability stems from inadequate input sanitization and output escaping within the plugin's AI chat data tracking functionality, permitting unauthenticated attackers to embed malicious scripts that execute upon user interaction with the affected page.


The AI Engine plugin for WordPress contains a critical vulnerability in versions up to and including 2.2.0, allowing for Unauthenticated Stored Cross-Site Scripting attacks. This security flaw has been rectified in version 2.2.1, safeguarding the plugin from such exploits.

Detailed Overview:

Discovered by the security researcher rootxsudip, this vulnerability underscores the importance of rigorous input validation and output encoding in web development, particularly in plugins that handle dynamic content and user interactions. The potential for attackers to inject and execute harmful scripts poses a significant risk to site integrity and user security. The prompt issuance of the 2.2.1 patch by the AI Engine development team is a critical measure to protect WordPress sites utilizing this plugin from XSS attacks.

Advice for Users:

  • Immediate Action: It is imperative for users of the AI Engine plugin to update to the patched version, 2.2.1, without delay to mitigate the vulnerability and secure their sites.
  • Check for Signs of Vulnerability: Site administrators should remain vigilant for any unusual site behavior or unauthorized content modifications, which could indicate exploitation of this vulnerability.
  • Alternate Plugins: While the patched version addresses this specific issue, users may consider exploring alternative plugins that offer similar AI functionalities while demonstrating a strong commitment to security.
  • Stay Updated: Ensuring that all WordPress plugins are kept up-to-date is crucial for protecting against known vulnerabilities and maintaining a secure online presence.


The identification and swift remediation of the Unauthenticated Stored Cross-Site Scripting vulnerability in the AI Engine plugin highlight the ongoing challenges in web security. This incident serves as a vital reminder of the necessity for regular software updates and proactive security practices to safeguard digital assets. For small business owners and website operators, prioritizing these practices is essential in protecting their digital presence and maintaining the trust of their users in an increasingly interconnected and digitally reliant world.


In an era where digital presence is crucial for businesses and individuals alike, the security of online platforms takes center stage. The discovery of a significant vulnerability in the AI Engine WordPress plugin, tagged as CVE-2024-0378, starkly reminds us of the cyber threats that constantly shadow the digital realm. This plugin, revered for infusing WordPress sites with cutting-edge AI functionalities like chatbots and content generators, has fallen prey to a security flaw that could potentially compromise user interactions and site integrity.

AI Engine: A Cornerstone for WordPress AI Functionality

AI Engine stands out in the WordPress ecosystem for its ability to empower websites with advanced AI capabilities, including GPT-4 assistants and dynamic content creation tools. Developed by tigroumeow, the plugin has garnered significant attention, with over 1.8 million downloads and 60,000 active installations. Its role in enhancing site interactivity and user engagement is undeniable, making any vulnerability within it a matter of concern for a wide user base.

Vulnerability Insights: CVE-2024-0378

CVE-2024-0378 exposes a critical flaw in AI Engine versions up to 2.2.0, specifically within its AI chat data tracking feature. This Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability, due to inadequate input sanitization and output escaping, permits malicious script injections by unauthenticated users. Highlighted by researcher rootxsudip and publicly disclosed on March 1, 2024, this vulnerability poses a significant risk, potentially allowing attackers to manipulate user interactions and access sensitive information.

Potential Risks and Impacts

The vulnerability within AI Engine could lead to severe consequences, including unauthorized access to sensitive data, manipulation of site content, and erosion of user trust. For businesses leveraging WordPress, such security breaches could not only disrupt operations but also tarnish reputations and lead to potential legal implications.

Mitigation and User Guidance

In response to CVE-2024-0378, the AI Engine development team released patch 2.2.1, effectively addressing this vulnerability. Users of the plugin are urged to update to this latest version promptly to secure their sites. Additionally, regular monitoring for unusual site activity and adherence to best practices in web security can further fortify defenses against potential exploits.

Historical Context and Ongoing Vigilance

AI Engine has encountered three vulnerabilities since May 19, 2023, underscoring the importance of continuous vigilance in the digital landscape. Each incident serves as a learning opportunity, reinforcing the need for regular updates and proactive security measures.

The Imperative of Security Awareness

The revelation of CVE-2024-0378 within AI Engine underscores a broader narrative in the realm of digital security: the imperative of staying abreast of potential vulnerabilities and taking decisive action to mitigate risks. For small business owners navigating the complexities of online operations, the security of digital assets is paramount. Prioritizing regular updates, being informed about the latest security threats, and implementing robust security protocols are not merely best practices but essential strategies for safeguarding digital platforms in an interconnected and increasingly vulnerable digital ecosystem. In the face of evolving cyber threats, a proactive stance on security is the linchpin of maintaining trust, integrity, and the continued success of digital endeavors.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

AI Engine Vulnerability – Unauthenticated Stored Cross-Site Scripting – CVE-2024-0378 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment