CVE-2024-0378

Medium

Published: 02 March 2024

Published

02 March 2024

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Score 0.0624 91.1th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-0378 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jordymeow Ai Engine. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain.

Deeper analysis

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is affected by a stored cross-site scripting vulnerability (CWE-79) in all versions through 2.2.0. The flaw occurs when discussion tracking is enabled and stems from insufficient input sanitization and output escaping on AI chat data, allowing arbitrary script injection into pages that render the chat content.

Unauthenticated attackers can supply malicious chat data that is stored by the plugin and later executed in the browsers of users who view the affected pages. Successful exploitation yields the ability to perform actions on behalf of the victim user within the WordPress site context, with a CVSS 3.1 base score of 6.5 reflecting network-accessible attack complexity that requires no authentication or user interaction.

The referenced Wordfence advisory and WordPress plugin repository changesets document the availability of a patched version that addresses the sanitization and escaping deficiencies. No public information is provided on real-world exploitation activity. The associated EPSS scores remain low, moving only modestly between 0.0624 and a peak of 0.0796.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-16174

Vulnerability details

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient…

input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s): CWE-79

AI Security AnalysisAI

AI Category: Enterprise AI Assistants
Risk Domain: Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: The vulnerability affects the 'AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!' WordPress plugin, which provides AI chatbots, generators, and assistants, aligning with Enterprise AI Assistants category.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1555.003 Credentials from Web Browsers Credential Access

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Unauthenticated stored XSS in WordPress plugin enables exploitation of public-facing application (T1190) to inject and execute arbitrary JavaScript (T1059.007), facilitating theft of credentials from web browsers (T1503) and web session cookies (T1539).