What’s Vulnerable › Products
AI Engine vulnerabilities
39 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.
Check whether your AI Engine version is affected
Latest AI Engine vulnerabilities
- CVE-2026-110982 — AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt (CVSS 4.9)
- CVE-2026-111041 — AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media (CVSS 4.9)
- CVE-2026-110976 — AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media (CVSS 4.9)
- CVE-2026-96561 — AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection (CVSS 7.2)
- CVE-2026-93623 — WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- CVE-2026-89141 — AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter (CVSS 6.5)
- CVE-2026-75798 — AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant (CVSS 5.3)
- CVE-2026-75797 — AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter (CVSS 7.7)
- CVE-2026-75796 — AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools (CVSS 7.2)
- CVE-2026-16955 — AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription (CVSS 5.0)
- CVE-2026-16953 — AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie (CVSS 4.8)
- CVE-2026-65545 — WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-16954 — AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens (CVSS 6.5)
- CVE-2026-15988 — AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match (CVSS 8.8)
- CVE-2026-12510 — AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR (CVSS 5.9)
- CVE-2026-12511 — AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal (CVSS 8.1)
- CVE-2026-8719 — AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token (CVSS 8.8)
- CVE-2026-23802 — WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability (CVSS 9.1)
- CVE-2026-1400 — AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint (CVSS 7.2)
- CVE-2026-0746 — AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4)
- CVE-2025-8084 — AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery (CVSS 6.8)
- CVE-2025-12844 — AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization (CVSS 7.1)
- CVE-2025-11749 — AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation (CVSS 9.8)
- CVE-2025-8268 — Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion (CVSS 6.5)
- CVE-2025-7847 — AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)