Skip to contentTigroumeow Ai Engine vulnerabilities
- tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiAI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client RegistrationCVE-2026-1107327.5 High
- tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiAI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' ParameterCVE-2026-1077454.2 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt InjectionCVE-2026-965617.2 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' ParameterCVE-2026-891416.5 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring MatchCVE-2026-159888.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer TokenCVE-2026-87198.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata EndpointCVE-2026-14007.2 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request ForgeryCVE-2026-07466.4 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request ForgeryCVE-2025-80846.8 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR DeserializationCVE-2025-128447.1 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationCVE-2025-11749Public exploitEPSS 74.8%9.8 Critical
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAi Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And DeletionCVE-2025-82686.5 Medium
- jordy meow ai engineAI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File UploadCVE-2025-7847Public exploit8.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio FunctionsCVE-2025-77806.5 Medium
- meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 moreAI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` ParameterCVE-2025-55705.4 Medium
- jordy meow ai engineAI Engine 2.8.4 - Insecure OAuth ImplementationCVE-2025-62388.0 High
- jordy meow ai engineAI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCPCVE-2025-50718.8 High
- jordymeow ai engine, jordy meow ai-engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +2 moreAI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-03786.5 Medium
- meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 moreAI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_urlCVE-2024-06996.6 Medium