Skip to contentTigroumeow Ai Engine – The Chatbot, Ai Framework & Mcp For Wordpress vulnerabilities
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt InjectionCVE-2026-965617.2 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' ParameterCVE-2026-891416.5 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring MatchCVE-2026-159888.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer TokenCVE-2026-87198.8 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata EndpointCVE-2026-14007.2 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request ForgeryCVE-2026-07466.4 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request ForgeryCVE-2025-80846.8 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR DeserializationCVE-2025-128447.1 High
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationCVE-2025-11749Public exploitEPSS 74.8%9.8 Critical
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAi Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And DeletionCVE-2025-82686.5 Medium
- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio FunctionsCVE-2025-77806.5 Medium
- meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 moreAI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` ParameterCVE-2025-55705.4 Medium
- jordymeow ai engine, jordy meow ai-engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +2 moreAI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-03786.5 Medium
- meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 moreAI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_urlCVE-2024-06996.6 Medium