# tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress. Every CVE that names tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model\_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection](https://agentprime.io/advisories/CVE-2026-96561.md) `CVE-2026-96561` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS) - [AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter](https://agentprime.io/advisories/CVE-2026-89141.md) `CVE-2026-89141` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control - [AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match](https://agentprime.io/advisories/CVE-2026-15988.md) `CVE-2026-15988` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 8.8 High · Not analysed yet · Published 1 Aug 2026 · Tags: Cross-site request forgery (CSRF) - [AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token](https://agentprime.io/advisories/CVE-2026-8719.md) `CVE-2026-8719` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 8.8 High · Not analysed yet · Published 17 May 2026 · Tags: Privilege escalation - [AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint](https://agentprime.io/advisories/CVE-2026-1400.md) `CVE-2026-1400` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 7.2 High · Not analysed yet · Published 28 Jan 2026 · Tags: Unrestricted file upload - [AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-0746.md) `CVE-2026-0746` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.4 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Server-side request forgery (SSRF) - [AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-8084.md) `CVE-2025-8084` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Server-side request forgery (SSRF) - [AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization](https://agentprime.io/advisories/CVE-2025-12844.md) `CVE-2025-12844` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 7.1 High · Not analysed yet · Published 13 Nov 2025 · Tags: Insecure deserialization - [AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation](https://agentprime.io/advisories/CVE-2025-11749.md) `CVE-2025-11749` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.75 · Not analysed yet · Published 5 Nov 2025 · Tags: Information disclosure - [Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion](https://agentprime.io/advisories/CVE-2025-8268.md) `CVE-2025-8268` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Broken access control - [AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions](https://agentprime.io/advisories/CVE-2025-7780.md) `CVE-2025-7780` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2025 · Tags: Information disclosure - [AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \`mwai_chatbot\` Shortcode \`id\` Parameter](https://agentprime.io/advisories/CVE-2025-5570.md) `CVE-2025-5570` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 5.4 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Cross-site scripting (XSS) - [AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-0378.md) `CVE-2024-0378` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 2 Mar 2024 · Tags: Cross-site scripting (XSS) - [AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url](https://agentprime.io/advisories/CVE-2024-0699.md) `CVE-2024-0699` · CVE record: tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress · CVSS 6.6 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: Unrestricted file upload ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .