AE
Product
AI Engine – The Chatbot, AI Framework & MCP for WordPress
12
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 5Medium 6Low 0
Watch
Add AI Engine – The Chatbot, AI Framework & MCP for WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-15988 | 8.8 | Aug 1 | AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match Affected: through 3.6.5 |
| CVE-2026-8719 | 8.8 | May 17 | AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token Affected: 3.4.9 |
| CVE-2026-96561 | 7.2 | Oct 1 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection Affected: through 3.8.0 |
| CVE-2026-1400 | 7.2 | Jan 28 | AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint Affected: through 3.3.2 |
| CVE-2025-12844 | 7.1 | Nov 13 | AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization Affected: through 3.1.8 |
Showing 5