CVE-2023-2580 AI-Engine < 1.6.83 - Admin+ Stored XSS
High-privilege users can inject malicious scripts into AI Engine plugin settings, leading to stored XSS in multisite environments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-2580?
CVE-2023-2580 is a medium-severity cross-site scripting vulnerability in Unknown AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable, published on 27 Jun 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Which versions are affected by CVE-2023-2580?
It affects 1 product.
Products include Meowapps Ai Engine.
How do I fix CVE-2023-2580?
No fix has been published for CVE-2023-2580 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-2580 being exploited?
There is no known exploitation of CVE-2023-2580 in the wild and no public exploit code.
Other vulnerabilities in Unknown AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable
- CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
- CVE-2024-34440 WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability
- CVE-2024-29100 WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability
- CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
- CVE-2025-6238 AI Engine 2.8.4 - Insecure OAuth Implementation
Sources
Also known as GHSA-g2r6-mg39-w7jm.