Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: tigroumeow Component: Ai Engine Clear all filters
TI-2025-05010 CVE-2025-5570 · GHSA-vjwp-h27m-5g29

AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

Priority LOW 24

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00198 Published 2025-07-08 No fix listed CWE-79
TI-2025-05644 CVE-2025-6238 · GHSA-6wxr-g84w-3h8x

AI Engine 2.8.4 - Insecure OAuth Implementation

Priority LOW 37

The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00368 Published 2025-07-04 No fix listed CWE-601
TI-2025-04546 CVE-2025-5071 · GHSA-gg23-wpg2-g99p

AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

Priority MEDIUM 41

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00671 Published 2025-06-19 No fix listed CWE-863
TI-2024-09725 CVE-2024-10499 · GHSA-5w62-ppvg-pwpq

AI-Engine < 2.6.5 - Admin+ SQLi

Priority HIGH 67

The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00613 Published 2024-12-12 Fixed in 2.6.5 CWE-89
TI-2024-06230 CVE-2024-6723 · GHSA-gr4h-g2ph-j8j2

AI Engine < 2.4.8 - Admin+ SQLi

Priority MEDIUM 55

The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.0045 Published 2024-09-13 Fixed in 2.4.8 CWE-89
TI-2024-05988 CVE-2024-6451 · GHSA-q636-fx55-gfr2

AI Engine < 2.5.1 - Admin+ RCE

Priority HIGH 67

AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00817 Published 2024-08-19 Fixed in 2.5.1 CWE-532
TI-2024-19274 CVE-2024-29100 · GHSA-539g-ppw2-7c4r

WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

Priority MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00644 Published 2024-03-28 No fix listed CWE-434
TI-2024-00644 CVE-2024-0699 · GHSA-7m74-4w6g-p6gf

AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url

Priority LOW 36

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01211 Published 2024-02-05 No fix listed CWE-434
TI-2023-02411 CVE-2023-2580 · GHSA-g2r6-mg39-w7jm

AI-Engine < 1.6.83 - Admin+ Stored XSS

Priority LOW 22

The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0047 Published 2023-06-27 Fixed in 1.6.83