Tigroumeow vulnerabilities

Products

• Ai Engine – The Chatbot, Ai Framework & Mcp For Wordpress 14
• Meow Gallery 4
• Ai Engine 3
• Ai Engine – Mcp Server & Ai Chatbot For Wordpress, With Claude, Chatgpt & Gemini 2
• Meow Lightbox 2
• Photo Engine (media Organizer & Lightroom) 2

Newest

• jordy meow photo engine (media organizer & lightroom) Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name CVE-2026-120575 6.4 MediumNovember 3, 2026
• tigroumeow seo engine – smart seo with ai, schema & redirection for wordpress SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title() CVE-2026-120552 6.4 MediumNovember 3, 2026
• tigroumeow perfect images: regenerate thumbnails, image sizes, webp & avif Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement CVE-2025-11455 4.3 MediumOctober 31, 2026
• tigroumeow meow lightbox Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization CVE-2026-109234 7.2 HighOctober 31, 2026
• jordy meow meow gallery Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) CVE-2026-9239 6.4 MediumOctober 30, 2026
• jordy meow meow gallery Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint CVE-2026-13747 6.5 MediumOctober 30, 2026
• tigroumeow database cleaner: cleanup, optimization & repair Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion CVE-2025-8574 8.7 HighOctober 30, 2026
• tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & gemini AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration CVE-2026-110732 7.5 HighOctober 30, 2026
• tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & gemini AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter CVE-2026-107745 4.2 MediumOctober 28, 2026
• jordy meow photo engine (media organizer & lightroom) Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action CVE-2026-107770 6.8 MediumOctober 16, 2026
• jordy meow gallery custom links Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body CVE-2026-107757 4.9 MediumOctober 14, 2026
• tigroumeow meow lightbox Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name CVE-2026-107756 6.4 MediumOctober 14, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection CVE-2026-96561 7.2 HighOctober 1, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter CVE-2026-89141 6.5 MediumSeptember 15, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match CVE-2026-15988 8.8 HighAugust 1, 2026
• tigroumeow media cleaner: clean your wordpress! Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery CVE-2026-4912 4.1 MediumJuly 28, 2026
• tigroumeow code engine – php snippets, ai functions & automation for wordpress Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution CVE-2025-6784 8.8 HighJuly 11, 2026
• jordy meow meow gallery Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation CVE-2026-1291 4.3 MediumJune 13, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token CVE-2026-8719 8.8 HighMay 17, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint CVE-2026-1400 7.2 HighJanuary 28, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2026-0746 6.4 MediumJanuary 27, 2026
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery CVE-2025-8084 6.8 MediumNovember 18, 2025
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization CVE-2025-12844 7.1 HighNovember 13, 2025
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation CVE-2025-11749 Public exploit EPSS 74.8% 9.8 CriticalNovember 5, 2025
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion CVE-2025-8268 6.5 MediumSeptember 3, 2025
• jordy meow ai engine AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-7847 Public exploit 8.8 HighJuly 31, 2025
• tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions CVE-2025-7780 6.5 MediumJuly 24, 2025
• meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 more AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter CVE-2025-5570 5.4 MediumJuly 8, 2025
• jordy meow ai engine AI Engine 2.8.4 - Insecure OAuth Implementation CVE-2025-6238 8.0 HighJuly 4, 2025
• jordy meow ai engine AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP CVE-2025-5071 8.8 HighJune 19, 2025
• jordy meow meow gallery Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-4386 6.4 MediumMay 9, 2024
• jordymeow ai engine, jordy meow ai-engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +2 more AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting CVE-2024-0378 6.5 MediumMarch 2, 2024
• meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 more AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url CVE-2024-0699 6.6 MediumFebruary 5, 2024