WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ai-engine
Published
2026-06-25
Title
AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR
Slug
ai-engine
Published
2026-07-30
Title
AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
Slug
ai-engine
Published
2026-07-31
Title
AI Engine < 3.6.6 - Administrator Account Creation via CSRF
Slug
ai-engine
Published
2026-07-28
Title
AI Engine < 3.6.9 - Unauthenticated Stored XSS
Slug
ai-engine
Published
2026-08-03
Title
AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie
Slug
ai-engine
Published
2026-08-03
Title
AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
Slug
ai-engine
Published
2026-08-19
Title
AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
Slug
ai-engine
Published
2026-08-24
Title
AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant
Slug
ai-engine
Published
2026-08-24
Title
AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter
Slug
ai-engine
Published
2026-09-23
Title
AI Engine – The Chatbot, AI Framework & MCP for WordPress < 3.7.9 - Unauthenticated Insecure Direct Object Reference
Slug
ai-engine
Published
2026-09-14
Title
AI Engine < 3.7.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
Slug
ai-engine
Published
2026-09-30
Title
AI Engine < 3.8.1 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
Slug
ai-engine
Published
2026-10-15
Title
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini < 3.8.4 - Missing Authorization
Slug
ai-engine
Published
2026-10-16
Title
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
Slug
ai-engine
Published
2026-10-16
Title
AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
Slug
ai-engine
Published
2026-10-19
Title
AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt
Slug
ai-engine
Published
2026-10-27
Title
AI Engine < 3.8.5 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
Slug
ai-engine
Published
2026-10-26
Title
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini < 3.8.7 - Missing Authorization
Slug
ai-engine
Published
2026-10-30
Title
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini < 3.8.9 - Cross-Site Request Forgery
Slug
ai-engine
Published
2026-10-29
Title
AI Engine – The Chatbot, AI Framework & MCP for WordPress < 3.8.7 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
Slug
ai-engine-pro
Published
2026-03-28
Title
AI Engine (Pro) < 3.4.2 - Missing Authorization
Slug
ai-feeds
Published
2025-11-25
Title
AI Feeds < 1.0.12 - Unauthenticated Arbitrary File Upload
Slug
ai-feeds
Published
2025-12-11
Title
AI Feeds < 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode
Slug
ai-for-seo
Published
2025-01-06
Title
AI for SEO < 1.2.10 - Missing Authorization
Slug
ai-for-seo
Published
2026-08-07
Title
SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot) < 2.4.3 - Missing Authorization