AI Engine – The Chatbot, AI Framework & MCP for WordPress vulnerabilities
7 known vulnerabilities in AI Engine – The Chatbot, AI Framework & MCP for WordPress from Tigroumeow. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Improper Neutralization of Input During Web Page Generation
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-
- 8.8 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Cross-Site Request Forgery
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function
- 8.8 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Improper Privilege Management
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Unrestricted Upload of File with Dangerous Type
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This m
- 7.1 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Deserialization of Untrusted Data
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. Thi
- 9.8 Critical severity
AI Engine – The Chatbot, AI Framework & MCP…: Exposure of Sensitive Information to an Unauthorized Actor
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for un
- 7.2 High severity
AI Engine – The Chatbot, AI Framework & MCP…: Unrestricted Upload of File with Dangerous Type
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it po