AI Engine – The Chatbot, AI Framework & MCP for WordPress

Уязвимости

• CVE-2025-11749

  AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

  Критич. 9.8

• CVE-2023-51409

  WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

  Критич. 9.8

• CVE-2026-23802

  WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability

  Критич. 9.1

• CVE-2026-15988

  AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match

  Высокий 8.8

• CVE-2026-8719

  AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token

  Высокий 8.8

• CVE-2025-7847

  AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload

  Высокий 8.8

• CVE-2025-5071

  AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

  Высокий 8.8

• CVE-2025-6238

  AI Engine 2.8.4 - Insecure OAuth Implementation

  Высокий 8.0

• CVE-2026-96561

  AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

  Высокий 7.2

• CVE-2026-27407

  WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

  Высокий 7.2

• CVE-2026-1400

  AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint

  Высокий 7.2

• CVE-2024-34440

  WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability

  Высокий 7.2

• CVE-2024-29100

  WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

  Высокий 7.2

• CVE-2024-0699

  AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url

  Высокий 7.2

• CVE-2026-65545

  WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2024-38791

  WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability

  Высокий 7.1

• CVE-2025-8084

  AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery

  Средний 6.8

• CVE-2024-29090

  WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

  Средний 6.8

• CVE-2026-89141

  AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

  Средний 6.5

• CVE-2025-8268

  Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion

  Средний 6.5

• CVE-2025-7780

  AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions

  Средний 6.5

• CVE-2026-0746

  AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery

  Средний 6.4

• CVE-2024-0378

  AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

  Средний 6.1

• CVE-2025-5570

  AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

  Средний 5.4

• CVE-2026-93623

  WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

  Средний 5.3