340 matches found
CVE-2025-11749
CVE-2025-11749 AI Engine = 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation ⚠️ AI Engine = 3.1.3 — Unauthenticated Sensitive Information Exposure → Privilege Escalation GitHub: Nxploited Telegram: @KNxploited IMPORTANT NOTICE: Many unethical individuals attempt to...
CVE-2023-51409
CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...
Jordy Meow AI Engine - Unrestricted File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...
WordPress AI Engine Plugin - Token Exposure
Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...
0-click-RCE-Exploit-for-CVE-2023-51409
CVE-2023-51409 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858586463777989073 This repository contains a proof-of-concept exploit for CVE-2023-51409, an unauthenticated arbitrary file upload vulnerability in the AI Engine: ChatGPT Chatbot WordPress plugin,...
WordPress AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin AI Engine versions = 3.8.0...
CVE-2025-13380
WordPress用AI Engine: ChatGPT, GPT Content Generator = 1.0.1 - 認証済み（Contributor以上）任意ファイル読み取り このWordPress用AI Engineプラグインには、画像挿入機能に脆弱性があり、投稿編集権限を持つ認証済みユーザー （Contributor、Author、Editor、Administrator）がサーバーから任意のファイルをダウンロードできるようになります。この脆弱性は、lqdaiupdatepost...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
EUVD-2026-90465
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2025-7847-POC
CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...
CVE-2026-93623
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
EUVD-2026-85465
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
CVE-2026-93623 WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
CVE-2026-93623
The AI Engine WordPress plugin versions
WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by foehn in WordPress Plugin AI Engine versions = 3.7.8...
