tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress

• CVE-2026-96561 High 7.2 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection 0.3%
• CVE-2026-89141 Medium 6.5 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter 0.5%
• CVE-2026-15988 High 8.8 AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match 0.3%
• CVE-2026-8719 High 8.8 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token 0.4%
• CVE-2026-1400 High 7.2 AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint 0.7%
• CVE-2026-0746 Medium 6.4 AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery 0.2%
• CVE-2025-8084 Medium 6.8 AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery 0.5%
• CVE-2025-12844 High 7.1 AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization 0.5%
• CVE-2025-11749 Critical 9.8 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation 74.8%
• CVE-2025-8268 Medium 6.5 Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion 0.3%
• CVE-2025-7780 Medium 6.5 AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions 0.6%
• CVE-2025-5570 Medium 5.4 AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter 0.2%
• CVE-2024-0378 Medium 6.5 AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting 0.6%
• CVE-2024-0699 Medium 6.6 AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url 1.2%