tigroumeow

12 results · Clear filters · Feed

• High 7.2
  CVE-2026-109234

  Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

  The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it pos…

  tigroumeow Meow Lightbox Web / CMS
  Oct 31, 2026
• High 8.7
  CVE-2025-8574

  Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion

  The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, w…

  tigroumeow Database Cleaner: Cleanup, Optimization & Repair Web / CMS
  Oct 30, 2026
• High 7.5
  CVE-2026-110732

  AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration

  The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/…

  tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini Web / CMS
  Oct 30, 2026
• High 7.2
  CVE-2026-96561

  AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

  The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai…

  tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  Oct 1, 2026
• High 8.8
  CVE-2026-15988

  AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

  The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize functio…

  tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  Aug 1, 2026
• High 8.8
  CVE-2025-6784

  Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution

  The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This m…

  tigroumeow Code Engine – PHP Snippets, AI Functions & Automation for WordPress Web / CMS
  Jul 11, 2026
• High 8.8
  CVE-2026-8719

  AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token

  The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any vali…

  tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  May 17, 2026
• High 7.2
  CVE-2026-1400

  AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint

  The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This …

  tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  Jan 28, 2026
• High 7.1
  CVE-2025-12844

  AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization

  The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. Th…

  tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Web / CMS
  Nov 13, 2025
• High 8.8
  CVE-2025-7847 Public exploit

  AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

  The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level acces…

  tigroumeow AI Engine Web / CMS
  Jul 31, 2025
• High 8.0
  CVE-2025-6238

  AI Engine 2.8.4 - Insecure OAuth Implementation

  The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticate…

  tigroumeow AI Engine Web / CMS
  Jul 4, 2025
• High 8.8
  CVE-2025-5071

  AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

  The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated …

  tigroumeow AI Engine Web / CMS
  Jun 19, 2025