340 matches found
CVE-2025-11749
CVE-2025-11749 AI Engine = 3.1.3 - 未授权敏感信息泄露导致权限提升 ⚠️ AI Engine = 3.1.3 — 未授权敏感信息泄露 → 权限提升 GitHub: Nxploited Telegram: @KNxploited 重要通知： 许多不道德的个人试图通过转售或重命名脚本并声称原创来利用我编写的代码获利。本项目是免费的、独家的，并由 Khaled Alenazi Nxploited 官方发布。 🔎 概述 用于 WordPress 的 AI Engine 插件（版本 3.1.3 及以下）存在信息泄露漏洞，如果启用了某些插件配置，未认证用户可以通过暴露...
Jordy Meow AI Engine - Unrestricted File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...
WordPress AI Engine Plugin - Token Exposure
Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...
0-click-RCE-Exploit-for-CVE-2023-51409
CVE-2023-51409 / 零点击远程代码执行漏洞利用 作者：Joshua Provoste https://x.com/JoshuaProvoste/status/1858586463777989073 该仓库包含针对 CVE-2023-51409 的概念验证利用代码，该漏洞是 AI Engine: ChatGPT Chatbot WordPress 插件中的一个未经身份验证的任意文件上传漏洞，可导致远程命令执行 RCE。 脚本功能 该脚本通过存在漏洞的 REST 端点未经身份验证上传 PHP 载荷，将其部署到 WordPress 上传目录中，检测目标操作系统，并提供交互式远程...
WordPress AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin AI Engine versions = 3.8.0...
CVE-2025-13380
WordPress用AI Engine: ChatGPT, GPT Content Generator = 1.0.1 - 認証済み（Contributor以上）任意ファイル読み取り このWordPress用AI Engineプラグインには、画像挿入機能に脆弱性があり、投稿編集権限を持つ認証済みユーザー （Contributor、Author、Editor、Administrator）がサーバーから任意のファイルをダウンロードできるようになります。この脆弱性は、lqdaiupdatepost...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
EUVD-2026-90465
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2025-7847-POC
CVE-2025-7847 Wordpress插件 已验证订阅者任意文件上传 POC Wordpress插件 AI Engine 2.9.3 - 2.9.4 概念验证 请注意，此漏洞仅在启用“Public API”选项时才能被利用，该选项默认是禁用的，并且没有配置Bearer Token，也没有添加和用于保护API的自定义身份验证。 自动化版本 python3 exploit-auto.py --url "http://target.com" --username "Admin" --password "L87C4u" --file reverse.php --attacker-ip...
CVE-2023-51409
CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - 通过 restupload 进行未经验证的任意文件上传 描述: WordPress 的 AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! 插件在 'restupload' 函数中缺少文件类型验证，因此在所有版本（包括 1.9.98 及更早版本）中容易受到任意文件上传漏洞的影响。这使得未经身份验证的攻击者能够在受影响站点的服务器上上传任意文件，从而可能导致远程代码执行。 Severity: critical CVE...
CVE-2026-93623
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
EUVD-2026-85465
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
CVE-2026-93623
The AI Engine WordPress plugin versions
CVE-2026-93623 WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by foehn in WordPress Plugin AI Engine versions = 3.7.8...
