CVE-2026-2955

Name of the Vulnerable Software and Affected Versions AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.15

Description The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping involving the X-Forwarded-For header. Unauthenticated attackers can inject arbitrary web scripts into pages, which then execute when a user accesses the affected page. Practical exploitation is limited by a 20-character storage limit.

Recommendations Update to a version later than 1.4.14.