WordPress plugin · ai-engine
Is AI Engine safe?
Safe on 3.8.8 or newer.
The current version, 3.8.8, is past every affected range on record (44 of 46 records list one; 2 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 46
- High or critical
- 20
- Exploited
- none
- Current version
- 3.8.8
- Last updated
- Oct 27, 2026
- Active installs
- 90,000+
Every recorded flaw
- Oct 27, 2026AI Engine – The Chatbot, AI Framework & MCP for: Limited media file deletionCVE-2026-107745 · affects up to 3.8.4 · reported by WordfenceMedium 4.2
- Oct 26, 2026AI Engine: Missing AuthorizationCVE-2026-112828 · affects up to 3.8.6 · reported by PatchstackMedium 4.3
- Oct 21, 2026AI Engine: Does not check that the caller is allowed to edit the targeted object before updating its title and excerptCVE-2026-110982 · fixed in 3.8.6 · reported by WPScanMedium 4.9
- Oct 18, 2026AI Engine: Does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted objectCVE-2026-111041 · fixed in 3.7.9 · reported by WPScanMedium 4.9
- Oct 18, 2026AI Engine: Does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting itCVE-2026-110976 · fixed in 3.7.9 · reported by WPScanMedium 4.9
- Oct 15, 2026AI Engine: Missing AuthorizationCVE-2026-110888 · affects up to 3.8.3 · reported by PatchstackMedium 4.3
- Oct 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Stored Cross-Site ScriptingCVE-2026-96561 · affects up to 3.8.0 · reported by WordfenceHigh 7.2
- Sep 26, 2026MCP Server for WordPress: Does not perform an object-level authorization check on one of its workflow REST routesCVE-2026-96526 · fixed in 1.8.2 · reported by WPScanLow 2.7
- Sep 26, 2026MCP Server for WordPress: Does not perform an ownership or sufficient capability check on its workflow createCVE-2026-96525 · fixed in 1.8.2 · reported by WPScanLow 2.7
- Sep 26, 2026MCP Server for WordPress: Does not correctly verify the WordPress REST API nonce for cookie-authenticated requestsCVE-2026-96524 · fixed in 1.8.2 · reported by WPScanHigh 8.8
- Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-93623 · affects up to 3.7.8 · reported by PatchstackMedium 5.3
- Sep 15, 2026AI Engine – The Chatbot, AI Framework & MCP for: Insecure Direct Object ReferenceCVE-2026-89141 · affects up to 3.7.7 · reported by WordfenceMedium 6.5
- Aug 26, 2026AI Engine: Does not perform an authorisation check on one of its administration-only featuresCVE-2026-75798 · fixed in 3.7.2 · reported by WPScanMedium 5.3
- Aug 26, 2026AI Engine: Does not confine a caller-supplied URLCVE-2026-75797 · fixed in 3.7.2 · reported by WPScanHigh 7.7
- Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · fixed in 3.6.1 · reported by WPScanHigh 7.2
- Aug 8, 2026AI Engine: Does not confine a caller-supplied file path before reading it and forwarding the contents to an external serviceCVE-2026-16955 · fixed in 3.6.6 · reported by WPScanMedium 5
- Aug 8, 2026AI Engine: Does not verify ownership of a guest's uploaded chatbot files before deletionCVE-2026-16953 · fixed in 3.6.4 · reported by WPScanMedium 4.8
- Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · affects up to 3.6.8 · reported by PatchstackHigh 7.1
- Aug 6, 2026AI Engine: Does not redact secret configuration values before exposing them in an admin page's inline script dataCVE-2026-16954 · fixed in 3.6.4 · reported by WPScanMedium 6.5
- Aug 1, 2026AI Engine – The Chatbot, AI Framework & MCP for: Cross-Site Request ForgeryCVE-2026-15988 · affects up to 3.6.5 · reported by WordfenceHigh 8.8
- Jul 16, 2026AI Engine: Does not verify that a user owns the chatbot conversation referenced by a client-supplied identifierCVE-2026-12510 · fixed in 3.5.5 · reported by WPScanMedium 5.9
- Jul 14, 2026AI Engine: Does not sanitize a user-supplied filename before using it to write a downloaded fileCVE-2026-12511 · fixed in 3.5.5 · reported by WPScanHigh 8.1
- Jun 15, 2026Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-27407 · affects up to 3.4.9 · reported by PatchstackHigh 7.2
- May 17, 2026AI Engine – The Chatbot, AI Framework & MCP for: Privilege Escalation in version 3CVE-2026-8719 · reported by WordfenceHigh 8.8
- Mar 5, 2026AI Engine: Unrestricted Upload of File with Dangerous TypeCVE-2026-23802 · affects up to 3.3.2 · reported by PatchstackCritical 9.1
- Jan 28, 2026AI Engine – The Chatbot and AI Framework for: Arbitrary file uploadsCVE-2026-1400 · affects up to 3.3.2 · reported by WordfenceHigh 7.2
- Jan 27, 2026AI Engine: Server-Side Request ForgeryCVE-2026-0746 · affects up to 3.3.2 · reported by WordfenceMedium 6.4
- Nov 18, 2025AI Engine: Server-Side Request ForgeryCVE-2025-8084 · affects up to 3.1.8 · reported by WordfenceMedium 6.8
- Nov 13, 2025AI Engine: PHP Object InjectionCVE-2025-12844 · affects up to 3.1.8 · reported by WordfenceHigh 7.1
- Nov 5, 2025AI Engine: Sensitive Information ExposureCVE-2025-11749 · affects up to 3.1.3 · reported by Wordfence75% oddsCritical 9.8
- Sep 3, 2025AI Engine: Unauthorized access and loss of dataCVE-2025-8268 · affects up to 2.9.5 · reported by WordfenceMedium 6.5
- Jul 31, 2025AI Engine: Arbitrary file uploadsCVE-2025-7847 · reported by Wordfence1.2% oddsHigh 8.8
- Jul 24, 2025AI Engine: Sensitive Information ExposureCVE-2025-7780 · affects up to 2.9.4 · reported by WordfenceMedium 6.5
- Jul 7, 2025AI Engine: Stored Cross-Site ScriptingCVE-2025-5570 · affects up to 2.8.4 · reported by WordfenceMedium 5.4
- Jul 3, 2025AI Engine: Open redirect in version 2CVE-2025-6238 · affects 2.8.4 to 2.8.4 · reported by WordfenceHigh 8
- Jun 19, 2025AI Engine: Unauthorized modification of data and loss of dataCVE-2025-5071 · affects 2.8.0 to 2.8.3 · reported by WordfenceHigh 8.8
- Dec 12, 2024AI Engine: Does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statementCVE-2024-10499 · fixed in 2.6.5 · reported by WPScanHigh 7.2
- Sep 13, 2024AI Engine: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6723 · fixed in 2.4.8 · reported by WPScanMedium 4.7
- Aug 1, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-38791 · affects up to 2.4.7 · reported by PatchstackMedium 4.9
- May 14, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2024-34440 · affects up to 2.2.63 · reported by PatchstackCritical 9.1
- Apr 12, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2023-51409 · affects up to 1.9.98 · reported by Patchstack63% oddsCritical 10
- Mar 28, 2024AI Engine: ChatGPT Chatbot: Unrestricted Upload of File with Dangerous TypeCVE-2024-29100 · affects up to 2.1.4 · reported by PatchstackCritical 9.1
- Mar 28, 2024AI Engine: ChatGPT Chatbot: Server-Side Request Forgery (SSRF)CVE-2024-29090 · affects up to 2.1.4 · reported by PatchstackMedium 6.8
- Mar 2, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Stored Cross-Site ScriptingCVE-2024-0378 · affects up to 2.2.0 · reported by WordfenceMedium 6.5
- Feb 5, 2024AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!: Arbitrary file uploadsCVE-2024-0699 · affects up to 2.1.4 · reported by Wordfence1.2% oddsMedium 6.6
- Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · fixed in 1.6.83 · reported by WPScanMedium 4.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.