Log in Start free

tigroumeow

Products

ProductCVEsExploitedLatest
AI Engine – The Chatbot, AI Framework & MCP for WordPress14–Oct 1, 2026
Meow Gallery4–Oct 30, 2026
AI Engine3–Jul 31, 2025
Meow Lightbox2–Oct 31, 2026
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini2–Oct 30, 2026
Photo Engine (Media Organizer & Lightroom)2–Nov 3, 2026
SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress1–Nov 3, 2026
Code Engine – PHP Snippets, AI Functions & Automation for WordPress1–Jul 11, 2026
Database Cleaner: Cleanup, Optimization & Repair1–Oct 30, 2026
Gallery Custom Links1–Oct 14, 2026
Media Cleaner: Clean your WordPress!1–Jul 28, 2026
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF1–Oct 31, 2026

Exploited and recent CVEs

  • CVE-2026-120575 Medium 6.4 Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name 0.2%
  • CVE-2026-120552 Medium 6.4 SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title() 0.2%
  • CVE-2025-11455 Medium 4.3 Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement 0.2%
  • CVE-2026-109234 High 7.2 Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization 0.4%
  • CVE-2026-9239 Medium 6.4 Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) 0.3%
  • CVE-2025-8574 High 8.7 Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion 0.4%
  • CVE-2026-13747 Medium 6.5 Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint 0.4%
  • CVE-2026-110732 High 7.5 AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration 0.3%
  • CVE-2026-107745 Medium 4.2 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter 0.3%
  • CVE-2026-107770 Medium 6.8 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action 0.5%
  • CVE-2026-107757 Medium 4.9 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body 0.2%
  • CVE-2026-107756 Medium 6.4 Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name 0.3%
  • CVE-2026-96561 High 7.2 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection 0.3%
  • CVE-2026-89141 Medium 6.5 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter 0.5%
  • CVE-2026-15988 High 8.8 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match 0.3%
  • CVE-2026-4912 Medium 4.1 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery 0.4%
  • CVE-2025-6784 High 8.8 Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution 0.9%
  • CVE-2026-1291 Medium 4.3 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation 0.2%
  • CVE-2026-8719 High 8.8 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token 0.4%
  • CVE-2026-1400 High 7.2 AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint 0.7%
  • CVE-2026-0746 Medium 6.4 AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery 0.2%
  • CVE-2025-8084 Medium 6.8 AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery 0.5%
  • CVE-2025-12844 High 7.1 AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization 0.5%
  • CVE-2025-11749 Critical 9.8 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation 74.8%
  • CVE-2025-8268 Medium 6.5 Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion 0.3%
  • CVE-2025-7847 High 8.8 AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload 1.3%
  • CVE-2025-7780 Medium 6.5 AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions 0.6%
  • CVE-2025-5570 Medium 5.4 AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter 0.2%
  • CVE-2025-6238 High 8.0 AI Engine 2.8.4 - Insecure OAuth Implementation 0.4%
  • CVE-2025-5071 High 8.8 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP 0.7%