AE
Product
AI Engine – The Chatbot, AI Framework & MCP for WordPress
12
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 1High 5Medium 6Low 0
Watch
Add AI Engine – The Chatbot, AI Framework & MCP for WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8084 | 6.8 | Nov 18 | AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery Affected: through 3.1.8 |
| CVE-2026-89141 | 6.5 | Sep 15 | AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter Affected: through 3.7.7 |
| CVE-2025-8268 | 6.5 | Sep 3 | Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion Affected: through 2.9.5 |
| CVE-2025-7780 | 6.5 | Jul 24 | AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions Affected: through 2.9.4 |
| CVE-2026-0746 | 6.4 | Jan 27 | AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery Affected: through 3.3.2 |
| CVE-2025-5570 | 5.4 | Jul 8 | AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter Affected: through 2.8.4 |
Showing 6