Advisories · Technology
tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress.
Every CVE that names tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Broken access control
- CVSS 8.8 High
AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Privilege escalation
- CVSS 7.2 High
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Unrestricted file upload
- CVSS 6.4 Medium
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Server-side request forgery (SSRF)
- CVSS 7.1 High
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Information disclosure
- CVSS 6.5 Medium
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Broken access control
- CVSS 6.5 Medium
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Information disclosure
- CVSS 5.4 Medium
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Unrestricted file upload