CVE-2026-65545 in AI Engine Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability represents a critical security flaw in the AI Engine software affecting versions 3.6.8 and earlier, where unauthenticated cross site scripting attacks can be executed against the system. The vulnerability stems from insufficient input validation and output encoding mechanisms within the application's web interface, allowing malicious actors to inject malicious scripts into web pages viewed by other users without requiring any authentication credentials. The flaw exists in the way the application processes user-supplied data through various input vectors including form fields, URL parameters, and API endpoints that are accessible to unauthenticated users.
The technical implementation of this vulnerability allows attackers to execute arbitrary JavaScript code within the context of a victim's browser session, potentially leading to complete compromise of user sessions and data theft. The vulnerability is classified under CWE-79 as a failure to sanitize input data before incorporating it into dynamically generated web content. Attackers can leverage this weakness to perform session hijacking, steal sensitive information, redirect users to malicious websites, or even inject malware through browser-based attacks. The impact extends beyond simple data exposure as the vulnerability enables persistent XSS attacks that can maintain control over user sessions for extended periods.
From an operational perspective, this vulnerability presents significant risk to organizations utilizing AI Engine versions 3.6.8 or earlier, as it allows attackers to exploit any user interaction with the vulnerable web interface regardless of authentication status. The attack surface includes all web-based interfaces and API endpoints that process user input without proper sanitization mechanisms. This vulnerability aligns with ATT&CK technique T1566.001 for initial access through spearphishing attachments and T1059.007 for command and control through script-based attacks. Organizations may experience unauthorized data access, session theft, and potential lateral movement within their network if attackers leverage this vulnerability to establish persistent access.
The recommended mitigation strategy involves immediate upgrade to AI Engine version 3.6.9 or later, which includes proper input validation and output encoding mechanisms to prevent XSS injection attempts. Additionally, organizations should implement comprehensive web application firewalls with XSS detection capabilities, deploy content security policies to restrict script execution, and conduct thorough security testing of all input validation mechanisms. Regular security assessments and penetration testing should be performed to identify similar vulnerabilities in related systems. Organizations must also establish proper incident response procedures to address potential exploitation attempts and ensure that all user sessions are invalidated following any suspected compromise events.