Plugin icon

AI Engine – The Chatbot, AI Framework & MCP for WordPress

ai-engine

Vulnerabilities:

22

Last Updated:

March 22, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-02-25
Title
AI Engine < 3.3.3 - Editor+ Arbitrary File Upload
Fixed in
Fixed in 3.3.3
CVSS
7.2 (high)
Published
2026-01-27
Title
AI Engine < 3.3.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Fixed in
Fixed in 3.3.3
CVSS
6.4 (medium)
Published
2026-01-27
Title
AI Engine < 3.3.3 - Editor+ Arbitrary File Upload
Fixed in
Fixed in 3.3.3
CVSS
7.2 (high)
Published
2025-11-18
Title
AI Engine < 3.1.9 - Authenticated (Editor+) Server-Side Request Forgery
Fixed in
Fixed in 3.1.9
CVSS
6.8 (medium)
Published
2025-11-12
Title
AI Engine < 3.1.9 - Subscriber+ PHP Object Injection via PHAR Deserialization
Fixed in
Fixed in 3.1.9
CVSS
7.1 (high)
Published
2025-11-04
Title
AI Engine < 3.1.4 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 3.1.4
CVSS
9.8 (critical)
Published
2025-09-03
Title
Ai Engine < 2.9.6 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
Fixed in
Fixed in 2.9.6
CVSS
6.5 (medium)
Published
2025-07-30
Title
AI Engine 2.9.3 - 2.9.4 - Subscriber+ Arbitrary File Upload
Fixed in
Fixed in 2.9.5
CVSS
8.8 (high)
Published
2025-07-23
Title
AI Engine < 2.9.5 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
Fixed in
Fixed in 2.9.5
CVSS
6.5 (medium)
Published
2025-07-07
Title
AI Engine < 2.8.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
Fixed in
Fixed in 2.8.5
CVSS
5.4 (medium)
Published
2025-07-03
Title
AI Engine 2.8.4 - Insecure OAuth Implementation
Fixed in
Fixed in 2.8.5
CVSS
8.0 (high)
Published
2025-06-18
Title
AI Engine 2.8.0 - 2.8.3 - Subscriber+ Privilege Escalation via MCP
Fixed in
Fixed in 2.8.4
CVSS
8.8 (high)
Published
2024-11-21
Title
AI-Engine < 2.6.5 - Admin+ SQLi
Fixed in
Fixed in 2.6.5
CVSS
4.1 (medium)
Published
2024-08-22
Title
AI Engine < 2.4.8 - Admin+ SQLi
Fixed in
Fixed in 2.4.8
CVSS
4.1 (medium)
Published
2024-07-29
Title
AI Engine < 2.5.1 - Admin+ RCE
Fixed in
Fixed in 2.5.1
CVSS
6.6 (medium)
Published
2024-07-22
Title
AI Engine < 2.4.8 - Authenticated (Subscriber+) Server-Side Request Forgery
Fixed in
Fixed in 2.4.8
CVSS
6.4 (medium)
Published
2024-05-07
Title
AI Engine: ChatGPT Chatbot < 2.2.70 - Authenticated (Editor+) Arbitrary File Upload
Fixed in
Fixed in 2.2.70
CVSS
9.1 (critical)
Published
2024-03-26
Title
AI Engine < 2.1.5 - Authenticated (Editor+) Server-Side Request Forgery
Fixed in
Fixed in 2.1.5
CVSS
6.4 (medium)
Published
2024-03-01
Title
AI Engine < 2.2.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.2.1
CVSS
6.5 (medium)
Published
2024-01-18
Title
AI Engine < 2.1.5 - Editor+ Arbitrary File Upload via add_image_from_url
Fixed in
Fixed in 2.1.5
CVSS
6.6 (medium)
Published
2024-01-09
Title
AI Engine: ChatGPT Chatbot < 1.9.99 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.9.99
CVSS
9.8 (critical)
Published
2023-05-30
Title
AI-Engine < 1.6.83 - Admin+ Stored XSS
Fixed in
Fixed in 1.6.83
CVSS
3.5 (low)