AI Engine – The Chatbot, AI Framework & MCP for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   AI Engine – The Chatbot, AI Framework & MCP for WordPress

Information

Software Type Plugin
Software Slug ai-engine (view on wordpress.org)
Software Status Active
Software Author tigroumeow
Software Website wordpress.org
Software Downloads 7,597,770
Software Active Installs 100,000
Software Record Last Updated September 7, 2026

Showing 1-20 of 34 Vulnerabilities

Submit a Vulnerability
AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure
2.7
CVE-2026-16954
Jul 30, 2026
Researcher: Revanth Hari Narayana Matte
AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure
4.3
CVE-2026-12510
Jun 25, 2026
Researcher: Shivamani Vastrala
AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable <= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2023-2580
May 19, 2023
Researcher: Felipe Restrepo Rodriguez (pfelilpe)
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
4.7
CVE-2026-75796
Aug 24, 2026
Researcher: Charles Vosburgh
AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-10499
Nov 21, 2024
Researcher: Emiliano Versini
AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-6723
Aug 22, 2024
Researcher: Karolis Narvilas
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution
5.3
CVE-2026-75798
Aug 28, 2026
Researcher: Abdullah Kareem
AI Engine <= 3.6.3 - Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion
5.3
CVE-2026-16953
Aug 3, 2026
Researcher: Revanth Hari Narayana Matte
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
5.4
CVE-2025-5570
Jul 7, 2025
Researcher: mikemyers
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2026-0746
Jan 27, 2026
Researcher: type5afe
AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2024-38791
Jul 22, 2024
Researcher: Yuchen Ji
AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery
6.4
CVE-2024-29090
Mar 26, 2024
Researcher: Rafie Muhammad
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read
6.5
CVE-2026-75797
Aug 27, 2026
Researcher: Jashid Sany
AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read
6.5
CVE-2026-16955
Aug 3, 2026
Researcher: Revanth Hari Narayana Matte
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
6.5
CVE-2025-8268
Sep 3, 2025
Researcher: ISMAILSHADOW
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
6.5
CVE-2025-7780
Jul 23, 2025
Researcher: ISMAILSHADOW
AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
6.5
CVE-2024-0378
Mar 1, 2024
Researcher: rootxsudip
AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url
6.6
CVE-2024-0699
Jan 18, 2024
Researcher: rootxsudip
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
6.8
CVE-2025-8084
Nov 18, 2025
Researcher: Jonas Benjamin Friedli
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
7.1
CVE-2025-12844
Nov 12, 2025
Researcher: ISMAILSHADOW
Title Status CVE ID CVSS Researchers Date
AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure Patched CVE-2026-16954 2.7 Revanth Hari Narayana Matte July 30, 2026
AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure Patched CVE-2026-12510 4.3 Shivamani Vastrala June 25, 2026
AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable <= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2023-2580 4.4 Felipe Restrepo Rodriguez (pfelilpe) May 19, 2023
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation Patched CVE-2026-75796 4.7 Charles Vosburgh August 24, 2026
AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection Patched CVE-2024-10499 4.9 Emiliano Versini November 21, 2024
AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection Patched CVE-2024-6723 4.9 Karolis Narvilas August 22, 2024
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution Patched CVE-2026-75798 5.3 Abdullah Kareem August 28, 2026
AI Engine <= 3.6.3 - Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion Patched CVE-2026-16953 5.3 Revanth Hari Narayana Matte August 3, 2026
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter Patched CVE-2025-5570 5.4 mikemyers July 7, 2025
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2026-0746 6.4 type5afe January 27, 2026
AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2024-38791 6.4 Yuchen Ji July 22, 2024
AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery Patched CVE-2024-29090 6.4 Rafie Muhammad March 26, 2024
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read Patched CVE-2026-75797 6.5 Jashid Sany August 27, 2026
AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read Patched CVE-2026-16955 6.5 Revanth Hari Narayana Matte August 3, 2026
Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion Patched CVE-2025-8268 6.5 ISMAILSHADOW September 3, 2025
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions Patched CVE-2025-7780 6.5 ISMAILSHADOW July 23, 2025
AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-0378 6.5 rootxsudip March 1, 2024
AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url Patched CVE-2024-0699 6.6 rootxsudip January 18, 2024
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery Patched CVE-2025-8084 6.8 Jonas Benjamin Friedli November 18, 2025
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization Patched CVE-2025-12844 7.1 ISMAILSHADOW November 12, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation