CVE-2026-2955 is a stored cross-site scripting vulnerability (CWE-79) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin. It occurs because the plugin does not properly sanitize or escape input from the 'X-Forwarded-For' header before storing and rendering it on web pages. This allows an unauthenticated attacker to inject malicious scripts that execute in the context of users viewing the affected pages. The practical impact is limited by a 20-character limit on stored input, which constrains the complexity of injected scripts. The vulnerability affects versions up to and including 1.4.14. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. However, the impact is limited by the short 20-character storage limit for the injected payload, reducing the scope of possible attacks. The vulnerability requires no user interaction and no privileges to exploit, but the attack surface is constrained by the input length restriction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to filter or sanitize the 'X-Forwarded-For' header or disable the plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.