meowapps ai engine vulnerabilities

Latest meowapps ai engine CVEs

Newest publication first

1. CVE-2025-5570 AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

   Published 2025-07-08

   Medium·CVSS 5.4 EPSS 0.20%

   The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

2. CVE-2025-6238 AI Engine 2.8.4 - Insecure OAuth Implementation

   Published 2025-07-04

   High·CVSS 8.0 EPSS 0.37%

   The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to interc...

3. CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP

   Published 2025-06-19

   High·CVSS 8.8 EPSS 0.67%

   The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subsc...

4. CVE-2024-10499 AI-Engine < 2.6.5 - Admin+ SQLi

   Published 2024-12-12

   High·CVSS 7.2 EPSS 0.61%

   The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks

5. CVE-2024-6723 AI Engine < 2.4.8 - Admin+ SQLi

   Published 2024-09-13

   Medium·CVSS 4.7 EPSS 0.45%

   The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.

6. CVE-2024-6451 AI Engine < 2.5.1 - Admin+ RCE

   Published 2024-08-19

   High·CVSS 7.2 EPSS 0.82%

   AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.

7. CVE-2024-38791 WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability

   Published 2024-08-01

   High·CVSS 7.1 EPSS 0.22%

   Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.

8. CVE-2024-34440 WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability

   Published 2024-05-13

   High·CVSS 7.2 EPSS 0.82%

   Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.

9. CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

   Published 2024-04-12

   Critical·CVSS 9.8 EPSS 63.1%

   Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98.

10. CVE-2024-29090 WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

    Published 2024-03-28

    Medium·CVSS 6.8 EPSS 0.89%

    Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

11. CVE-2024-29100 WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability

    Published 2024-03-28

    High·CVSS 7.2 EPSS 0.64%

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

12. CVE-2024-0699 AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url

    Published 2024-02-05

    High·CVSS 7.2 EPSS 1.2%

    The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authentic...

13. CVE-2023-2580 AI-Engine < 1.6.83 - Admin+ Stored XSS

    Published 2023-06-27

    Medium·CVSS 4.8 EPSS 0.47%

    The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite se...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.