AI Marketing Expert: Stored DOM-Based Cross-Site Scripting (CVE-2026-109999)

The AI Marketing Expert plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) via the 'name' parameter. The flaw stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The payload is stored via three unauthenticated REST calls and executes within the context of an administrator session when viewing the wp-admin/index.php dashboard.

Attack Chain

1. Attacker identifies an installation of the AI Marketing Expert plugin with the chatbot module active.
2. Attacker executes three unauthenticated REST API calls to the target WordPress site.
3. The 'name' parameter is injected with an XSS payload, which is improperly sanitized by the plugin.
4. The malicious payload is persisted in the plugin's chatbot configuration data.
5. An administrator logs into the WordPress dashboard and accesses wp-admin/index.php.
6. The plugin's JavaScript widget auto-poll mechanism retrieves the stored payload.
7. The browser renders the payload, executing the JavaScript in the administrator's security context.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript within the browser session of an authenticated WordPress administrator, potentially resulting in unauthorized administrative actions or data theft.

Recommendation

• Update the AI Marketing Expert plugin to a version beyond 1.2.8 immediately.
• If a patch is unavailable, disable the chatbot module within the plugin settings to mitigate the exploitation vector.
• Review WordPress REST API logs for anomalous unauthenticated POST requests targeting the plugin's configuration endpoints.