PatchSiren cyber security CVE debrief
CVE-2026-2955 wupsales CVE debrief
A stored cross-site scripting (XSS) vulnerability exists in the AI Chatbot & Workflow Automation by AIWU WordPress plugin (versions up to and including 1.4.14). The flaw stems from insufficient input sanitization and output escaping of the X-Forwarded-For HTTP header, allowing unauthenticated attackers to inject arbitrary web scripts. When a user accesses a page containing the injected payload, the script executes in their browser context. A 20-character storage limit constrains practical exploitation, reducing the severity from what a typical stored XSS might otherwise warrant. The vulnerability was disclosed on 2026-05-20 and carries a CVSS 3.1 score of 6.4 (Medium).
- Vendor
- wupsales
- Product
- AI Chatbot & Workflow Automation by AIWU
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-20
- Original CVE updated
- 2026-05-20
- Advisory published
- 2026-05-20
- Advisory updated
- 2026-05-20
Who should care
WordPress site administrators using the AI Chatbot & Workflow Automation by AIWU plugin; security teams monitoring for plugin-based XSS vectors; WAF operators managing header sanitization policies
Technical summary
The AI Chatbot & Workflow Automation by AIWU plugin fails to properly sanitize the X-Forwarded-For header before storing and displaying it. This stored XSS vulnerability allows unauthenticated attackers to inject limited-length scripts (constrained by a 20-character storage limit) that execute when administrators or other users view affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and changed scope with low confidentiality and integrity impact.
Defensive priority
medium
Recommended defensive actions
- Upgrade the AI Chatbot & Workflow Automation by AIWU plugin to version 1.4.15 or later
- Review access logs for anomalous X-Forwarded-For header values containing script tags or encoded payloads
- Implement Web Application Firewall (WAF) rules to sanitize or block suspicious X-Forwarded-For header content
- Audit plugin settings and database entries for unexpected script injections in visitor log or analytics tables
- Consider additional output encoding for any plugin-displayed header-derived data
Evidence notes
The vulnerability description and CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) are sourced from the official NVD record. The Wordfence advisory and plugin changeset confirm the affected component and remediation path. The 20-character storage limit is explicitly noted in the CVE description as a practical constraint on exploitation.
Official resources
2026-05-20