Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image GenerationGPT3 AI Content WriterAI Content Generator Marketing
Plugin · gpt3-ai-content-generator
GPT3 AI Content Writer
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 10, 2026AI Puffer – Chat. Create. Automate. (formerly AI Power): Authorization bypassCVE-2026-104742 · affects up to 2.4.89 · reported by WordfenceLow 3.1
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that an administrator has previously granted the Knowledge Base ('sources') module to the attacker's role via the Role Manager, as this access is not available to lower-privileged users by default.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026AI Puffer – Chat. Create. Automate. (formerly AI Power): Authorization bypassCVE-2026-104741 · affects up to 2.4.89 · reported by WordfenceLow 3.1
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in configurations where an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2025GPT3 AI Content Writer: Cross-Site Request Forgery (CSRF)CVE-2025-47470 · affects up to 1.9.14 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in senols GPT3 AI Content Writer gpt3-ai-content-generator allows Cross Site Request Forgery.This issue affects GPT3 AI Content Writer: from n/a through <= 1.9.14.
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0429 · affects up to 1.8.96 · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_ai_forms() function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Jan 22, 2025AI Power: Complete AI Pack: PHP Object InjectionCVE-2025-0428 · affects up to 1.8.96 · reported by WordfenceHigh 7.2
The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via deserialization of untrusted input from the $form['post_content'] variable through the wpaicg_export_prompts function. This allows authenticated attackers, with administrative privileges, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Jan 22, 2025AI Power: Complete AI Pack: Unauthorized accessCVE-2024-13361 · affects up to 1.8.96 · reported by WordfenceMedium 6.3
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.
Jan 22, 2025AI Power: Complete AI Pack: Server-Side Request ForgeryCVE-2024-13360 · affects up to 1.8.96 · reported by WordfenceMedium 5.4
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Oct 31, 2024AI Power: Complete AI Pack: Arbitrary file uploadsCVE-2024-10392 · affects up to 1.8.89 · reported by WordfenceCritical 9.8
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Jul 21, 2024GPT3 AI Content Writer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37465 · affects up to 1.8.66 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Senol Sahin GPT3 AI Content Writer allows Stored XSS.This issue affects GPT3 AI Content Writer: from n/a through 1.8.66.
Feb 29, 2024AI Power: Complete AI Pack – Powered by GPT-4: Cross-Site Request Forgery (CSRF)CVE-2023-51528 · affects up to 1.8.12 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.12.
Dec 29, 2023AI Power: Complete AI Pack – Powered by GPT-4: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51527 · affects up to 1.8.2 · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.