TI
Vendor
tigroumeow
29
CVEs
0
On KEV
9
New 30D
Products
AE9.8
AI Engine – The Chatbot, AI Framework & MCP for WordPress
tigroumeow
14 CVEs0 on KEV1 new
MG6.5
Meow Gallery
tigroumeow
4 CVEs0 on KEV2 new
AE7.5
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
tigroumeow
2 CVEs0 on KEV2 new
DC8.7
Database Cleaner: Cleanup, Optimization & Repair
tigroumeow
1 CVEs0 on KEV1 new
GC4.9
Gallery Custom Links
tigroumeow
1 CVEs0 on KEV1 new
ML6.4
Meow Lightbox
tigroumeow
1 CVEs0 on KEV1 new
PE6.8
Photo Engine (Media Organizer & Lightroom)
tigroumeow
1 CVEs0 on KEV1 new
AE8.8
AI Engine
tigroumeow
3 CVEs0 on KEV0 new
CE8.8
Code Engine – PHP Snippets, AI Functions & Automation for WordPress
tigroumeow
1 CVEs0 on KEV0 new
MC4.1
Media Cleaner: Clean your WordPress!
tigroumeow
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-9239 New | MG Meow Gallery tigroumeow | 6.4 | Oct 30 | Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) |
| CVE-2025-8574 New | DC Database Cleaner: Cleanup, Optimization & Repair tigroumeow | 8.7 | Oct 30 | Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion |
| CVE-2026-13747 New | MG Meow Gallery tigroumeow | 6.5 | Oct 30 | Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint |
| CVE-2026-110732 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 7.5 | Oct 30 | AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration |
| CVE-2026-107745 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 4.2 | Oct 28 | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter |
| CVE-2026-107770 | PE Photo Engine (Media Organizer & Lightroom) tigroumeow | 6.8 | Oct 16 | Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action |
| CVE-2026-107757 | GC Gallery Custom Links tigroumeow | 4.9 | Oct 14 | Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body |
| CVE-2026-107756 | ML Meow Lightbox tigroumeow | 6.4 | Oct 14 | Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name |
| CVE-2026-96561 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 7.2 | Oct 1 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection |
| CVE-2026-89141 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.5 | Sep 15 | AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter |
| CVE-2026-15988 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 8.8 | Aug 1 | AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match |
| CVE-2026-4912 | MC Media Cleaner: Clean your WordPress! tigroumeow | 4.1 | Jul 28 | Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery |
| CVE-2025-6784 | CE Code Engine – PHP Snippets, AI Functions & Automation for WordPress tigroumeow | 8.8 | Jul 11 | Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution |
| CVE-2026-1291 | MG Meow Gallery tigroumeow | 4.3 | Jun 13 | Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation |
| CVE-2026-8719 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 8.8 | May 17 | AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token |
| CVE-2026-1400 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 7.2 | Jan 28 | AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint |
| CVE-2026-0746 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.4 | Jan 27 | AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery |
| CVE-2025-8084 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.8 | Nov 18 | AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery |
| CVE-2025-12844 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 7.1 | Nov 13 | AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization |
| CVE-2025-11749 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 9.8 | Nov 5 | AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation |
| CVE-2025-8268 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.5 | Sep 3 | Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion |
| CVE-2025-7847 | AE AI Engine tigroumeow | 8.8 | Jul 31 | AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload |
| CVE-2025-7780 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.5 | Jul 24 | AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions |
| CVE-2025-5570 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 5.4 | Jul 8 | AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter |
| CVE-2025-6238 | AE AI Engine tigroumeow | 8.0 | Jul 4 | AI Engine 2.8.4 - Insecure OAuth Implementation |
| CVE-2025-5071 | AE AI Engine tigroumeow | 8.8 | Jun 19 | AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP |
| CVE-2024-4386 | MG Meow Gallery tigroumeow | 6.4 | May 9 | Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-0378 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 6.1 | Mar 2 | AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2024-0699 | AE AI Engine – The Chatbot, AI Framework & MCP for WordPress tigroumeow | 7.2 | Feb 5 | AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url |