Tigroumeow vulnerabilities
We track 14 vulnerabilities in Tigroumeow products across 6 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2026.
Latest Tigroumeow vulnerabilities
- 7.2 High severity
Meow Lightbox: Improper Neutralization of Input During Web Page Generation
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it poss
- 8.7 High severity
Database Cleaner: Cleanup, Optimization & Repair: Improper Access Control
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, wi
- 7.5 High severity
AI Engine – MCP Server & AI Chatbot for…: Missing Authorization
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Improper Neutralization of Input During Web Page Generation
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-
- 8.8 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Cross-Site Request Forgery
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function
- 8.8 High severity
Code Engine – PHP Snippets, AI Functions &…: Improper Neutralization of Special Elements used in a Command
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This ma
- 8.8 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Improper Privilege Management
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Unrestricted Upload of File with Dangerous Type
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This m
- 7.1 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Deserialization of Untrusted Data
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. Thi
- 9.8 Critical severity
AI Engine – The Chatbot, AI Framework & MCP…: Exposure of Sensitive Information to an Unauthorized Actor
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for un
- 8.8 High severity
AI Engine: Unrestricted Upload of File with Dangerous Type
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access
- 8.0 High severity
AI Engine: URL Redirection to Untrusted Site
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated
- 8.8 High severity
AI Engine: Incorrect Authorization
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated a
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Unrestricted Upload of File with Dangerous Type
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it po