Ai Engine

WordPress plugin · ai-engine · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Ai Engine on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.7	AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter CVE.org	>=3.3.3, <3.7.2	v3.7.2	CVE-2026-75797	Aug 26, 2026
HIGH CVSS 7.2	AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools CVE.org	>=2.8.0, <3.6.1	v3.6.1	CVE-2026-75796	Aug 21, 2026
HIGH CVSS 8.1	AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal CVE.org	>=0, <3.5.5	v3.5.5	CVE-2026-12511	Jul 14, 2026
MEDIUM CVSS 4.9	AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt CVE.org	>=0, <3.8.6	v3.8.6	CVE-2026-110982	Oct 21, 2026
MEDIUM CVSS 4.9	AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media CVE.org	>=0, <3.7.9	v3.7.9	CVE-2026-110976	Oct 18, 2026
MEDIUM CVSS 4.9	AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media CVE.org	>=0, <3.7.9	v3.7.9	CVE-2026-111041	Oct 18, 2026
MEDIUM CVSS 5.3	AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant CVE.org	>=3.4.0, <3.7.2	v3.7.2	CVE-2026-75798	Aug 26, 2026
MEDIUM CVSS 4.8	AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie CVE.org	>=0, <3.6.4	v3.6.4	CVE-2026-16953	Aug 8, 2026
MEDIUM CVSS 5.0	AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription CVE.org	>=0, <3.6.6	v3.6.6	CVE-2026-16955	Aug 8, 2026
MEDIUM CVSS 6.5	AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens CVE.org	>=0, <3.6.4	v3.6.4	CVE-2026-16954	Aug 6, 2026
MEDIUM CVSS 5.9	AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR CVE.org	>=0, <3.5.5	v3.5.5	CVE-2026-12510	Jul 16, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.