Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?AI EngineAI Engine (Pro)
Plugin · ai-engine
AI Engine
46 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 27, 2026AI Engine – The Chatbot, AI Framework & MCP for: Limited media file deletionCVE-2026-107745 · affects up to 3.8.4 · reported by WordfenceMedium 4.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_files task running after the malicious upload.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 26, 2026AI Engine: Missing AuthorizationCVE-2026-112828 · affects up to 3.8.6 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
Oct 21, 2026AI Engine: Does not check that the caller is allowed to edit the targeted object before updating its title and excerptCVE-2026-110982 · fixed in 3.8.6 · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.
Oct 18, 2026AI Engine: Does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted objectCVE-2026-111041 · fixed in 3.7.9 · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.
Oct 18, 2026AI Engine: Does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting itCVE-2026-110976 · fixed in 3.7.9 · reported by WPScanMedium 4.9
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.
Oct 15, 2026AI Engine: Missing AuthorizationCVE-2026-110888 · affects up to 3.8.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.
Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Stored Cross-Site ScriptingCVE-2026-96561 · affects up to 3.8.0 · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled string (including CR/LF) into $query->model; final_checks() throws an Exception whose message embeds that raw string, and the non-streaming, non-admin catch branch writes it to the PHP error log unmodified — creating a forged log line that the plugin's own parser subsequently returns as recent PHP-error content; run_advisor() then appends that content verbatim to the AI prompt (indirect prompt injection — CWE-1427), the returned JSON is stored in the mwai_advisor_data option with no schema validation o
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2026MCP Server for WordPress: Does not perform an object-level authorization check on one of its workflow REST routesCVE-2026-96526 · fixed in 1.8.2 · reported by WPScanLow 2.7
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
Sep 26, 2026MCP Server for WordPress: Does not perform an ownership or sufficient capability check on its workflow createCVE-2026-96525 · fixed in 1.8.2 · reported by WPScanLow 2.7
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.
Sep 26, 2026MCP Server for WordPress: Does not correctly verify the WordPress REST API nonce for cookie-authenticated requestsCVE-2026-96524 · fixed in 1.8.2 · reported by WPScanHigh 8.8
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.
Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-93623 · affects up to 3.7.8 · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Sep 15, 2026AI Engine – The Chatbot, AI Framework & MCP for: Insecure Direct Object ReferenceCVE-2026-89141 · affects up to 3.7.7 · reported by WordfenceMedium 6.5
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachment ID. This vulnerability requires the Public API module to be enabled in the plugin settings; when disabled, the REST route is absent and the endpoint returns HTTP 404.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2026AI Engine: Does not perform an authorisation check on one of its administration-only featuresCVE-2026-75798 · fixed in 3.7.2 · reported by WPScanMedium 5.3
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.
Aug 26, 2026AI Engine: Does not confine a caller-supplied URLCVE-2026-75797 · fixed in 3.7.2 · reported by WPScanHigh 7.7
The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · fixed in 3.6.1 · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
Aug 8, 2026AI Engine: Does not confine a caller-supplied file path before reading it and forwarding the contents to an external serviceCVE-2026-16955 · fixed in 3.6.6 · reported by WPScanMedium 5
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Aug 8, 2026AI Engine: Does not verify ownership of a guest's uploaded chatbot files before deletionCVE-2026-16953 · fixed in 3.6.4 · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · affects up to 3.6.8 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
Aug 6, 2026AI Engine: Does not redact secret configuration values before exposing them in an admin page's inline script dataCVE-2026-16954 · fixed in 3.6.4 · reported by WPScanMedium 6.5
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
Aug 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Cross-Site Request ForgeryCVE-2026-15988 · affects up to 3.6.5 · reported by WordfenceHigh 8.8
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-based REST authentication bypass, granted they can trick a site administrator into performing an action such as clicking on a link. This bypass can be combined with WordPress's ?_method=POST method-override support to convert a top-navigation GET request into an authenticated POST to the REST users endpoint, requiring no existing account on the attacker's part.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026AI Engine: Does not verify that a user owns the chatbot conversation referenced by a client-supplied identifierCVE-2026-12510 · fixed in 3.5.5 · reported by WPScanMedium 5.9
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.
Jul 14, 2026AI Engine: Does not sanitize a user-supplied filename before using it to write a downloaded fileCVE-2026-12511 · fixed in 3.5.5 · reported by WPScanHigh 8.1
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
Jun 15, 2026Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-27407 · affects up to 3.4.9 · reported by PatchstackHigh 7.2
Editor Privilege Escalation in AI Engine <= 3.4.9 versions.
May 17, 2026AI Engine – The Chatbot, AI Framework & MCP for: Privilege Escalation in version 3CVE-2026-8719 · reported by WordfenceHigh 8.8
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.
Mar 5, 2026AI Engine: Unrestricted Upload of File with Dangerous TypeCVE-2026-23802 · affects up to 3.3.2 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affects AI Engine: from n/a through <= 3.3.2.
Jan 28, 2026AI Engine – The Chatbot and AI Framework for: Arbitrary file uploadsCVE-2026-1400 · affects up to 3.3.2 · reported by WordfenceHigh 7.2
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The attacker can upload a benign image file, then use the `update_media_metadata` endpoint to rename it to a PHP file, creating an executable PHP file in the uploads directory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2026AI Engine: Server-Side Request ForgeryCVE-2026-0746 · affects up to 3.3.2 · reported by WordfenceMedium 6.4
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the 'get_audio' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, if "Public API" is enabled in the plugin settings, and 'allow_url_fopen' is set to 'On' on the server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025AI Engine: Server-Side Request ForgeryCVE-2025-8084 · affects up to 3.1.8 · reported by WordfenceMedium 6.8
The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025AI Engine: PHP Object InjectionCVE-2025-12844 · affects up to 3.1.8 · reported by WordfenceHigh 7.1
The AI Engine plugin for WordPress is vulnerable to PHP Object Injection via PHAR Deserialization in all versions up to, and including, 3.1.8 via deserialization of untrusted input in the 'rest_simpleTranscribeAudio' and 'rest_simpleVisionQuery' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Nov 5, 2025AI Engine: Sensitive Information ExposureCVE-2025-11749 · affects up to 3.1.3 · reported by WordfenceCritical 9.8
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025AI Engine: Unauthorized access and loss of dataCVE-2025-8268 · affects up to 2.9.5 · reported by WordfenceMedium 6.5
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2025AI Engine: Arbitrary file uploadsCVE-2025-7847 · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2025AI Engine: Sensitive Information ExposureCVE-2025-7780 · affects up to 2.9.4 · reported by WordfenceMedium 6.5
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTranscribeAudio endpoint fails to restrict URL schemes before calling get_audio(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to read any file on the web server and exfiltrate it via the plugin’s OpenAI API integration.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 7, 2025AI Engine: Stored Cross-Site ScriptingCVE-2025-5570 · affects up to 2.8.4 · reported by WordfenceMedium 5.4
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jul 3, 2025AI Engine: Open redirect in version 2CVE-2025-6238 · affects 2.8.4 to 2.8.4 · reported by WordfenceHigh 8
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025AI Engine: Unauthorized modification of data and loss of dataCVE-2025-5071 · affects 2.8.0 to 2.8.3 · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2024AI Engine: Does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statementCVE-2024-10499 · fixed in 2.6.5 · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
Sep 13, 2024AI Engine: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6723 · fixed in 2.4.8 · reported by WPScanMedium 4.7
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.
Aug 1, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-38791 · affects up to 2.4.7 · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
May 14, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2024-34440 · affects up to 2.2.63 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.
Apr 12, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2023-51409 · affects up to 1.9.98 · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.
Mar 28, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2024-29100 · affects up to 2.1.4 · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.
Mar 28, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-29090 · affects up to 2.1.4 · reported by PatchstackMedium 6.8
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.
Mar 2, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Stored Cross-Site ScriptingCVE-2024-0378 · affects up to 2.2.0 · reported by WordfenceMedium 6.5
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 5, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Arbitrary file uploadsCVE-2024-0699 · affects up to 2.1.4 · reported by WordfenceMedium 6.6
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.
Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · fixed in 1.6.83 · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.