Tigroumeow
Monthly
Stored cross-site scripting in the Meow Lightbox WordPress plugin, affecting all versions up to and including 5.6.4, lets an unauthenticated attacker save a crafted payload that executes JavaScript in the browser of any user who later views the injected page. Exploitation is heavily gated: the administrator must have enabled Output Buffering, selected the HtmlDomParser engine and enabled Aggressive Resolve, and the site must additionally expose a stored-HTML submission surface (the description cites anonymous bbPress replies) whose kses allow-list still preserves img attributes. Where those conditions are met a single unauthenticated submission is sufficient; no public exploit code and no CISA KEV entry were identified at time of analysis, and the issue is fixed in version 5.6.5.
Unauthenticated attackers can register an OAuth client with an attacker-controlled redirect URI against the AI Engine WordPress plugin's MCP OAuth 2.1 Dynamic Client Registration endpoint in all versions through 3.8.6, then obtain an administrator-bound MCP access token once an administrator approves the client on the OAuth consent screen - approval that can be obtained via clickjacking because the consent page lacks X-Frame-Options and CSP frame-ancestors. The flaw is CWE-862 missing authorization, caused by the register endpoint being exposed with a permission_callback of __return_true, and it is fixed in 3.8.7. Exploitation requires the opt-in MCP labs module to be active and administrator interaction (UI:R); no public exploit code and no CISA KEV entry are identified in the available data, and this is a high-severity, approval-gated issue rather than a drop-everything emergency.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Authenticated attackers can escalate privileges to Administrator in AI Engine WordPress plugin version 3.4.9 through improper authorization in the MCP OAuth bearer-token implementation. The plugin accepts any valid OAuth token for Model Context Protocol (MCP) access without verifying administrator privileges, allowing low-privileged users (Subscriber+) to execute admin-level MCP tools. No public exploit or active exploitation identified at time of analysis.
Stored cross-site scripting in the Meow Gallery WordPress plugin (all versions up to and including 5.5.1) lets an authenticated author-level user inject script through attachment alt text that is emitted into an aria-label attribute. Because WordPress's sanitize_text_field() strips angle-bracketed tags but leaves double quotes intact, an attacker can break out of the aria-label context and add event-handler attributes such as onclick that fire when a visitor views the injected gallery page. The vulnerable sink is only reached when gallery items are rendered as links (a non-empty link_href), and a patch appears in the 5.5.1-to-5.5.2 changeset; no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_month rather than immediate action.
Arbitrary deletion of WordPress core database tables is possible through the Database Cleaner plugin in all versions up to and including 1.4.7, because the plugin's table-deletion REST endpoint does not restrict which tables may be targeted. Rated CVSS 8.7 with a scope change (C:N/I:H/A:H), the flaw nonetheless requires the attacker to already hold Administrator-level credentials, so realistic risk is confined to sites with multiple, delegated, or potentially compromised admin accounts rather than default single-admin deployments. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; priority is this_week rather than emergency.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Limited arbitrary media file deletion affects the WordPress plugin AI Engine - MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini in all versions up to and including 3.8.4. An authenticated attacker holding only subscriber-level access can abuse insufficient path validation in the plugin's upload_file function to target media files outside the intended upload location, but three prerequisites must align: the administrator must have explicitly enabled the plugin's non-default Public API option, and the plugin's scheduled hourly cleanup_files task must run after the malicious upload before the deletion takes effect. Wordfence rates this Medium (CVSS 4.2, AC:H) with impact limited to integrity and availability of media files and no confidentiality exposure; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.
Remote code execution in the Code Engine WordPress plugin (all versions ≤ 0.3.5) lets authenticated users with Contributor-level access or higher run arbitrary PHP/code on the server via the 'code-engine' shortcode, because the plugin fails to restrict access to its code-injection functionality. Reported by Wordfence, the flaw carries a CVSS 8.8 (high) rating; there is no public exploit identified at time of analysis, though the technique (abusing a shortcode that intentionally executes snippets) is straightforward for anyone with authoring rights. This turns the plugin's core 'run PHP snippets' feature into a privilege-escalation path from low-trust content contributors to full server code execution.
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any authenticated user with Author-level access or above to overwrite or create arbitrary gallery shortcode records by supplying a user-controlled `id` parameter. The endpoint `/wp-json/meow-gallery/v1/save_shortcode` performs direct database write operations without verifying ownership of the referenced record, making this a classic CWE-639 (IDOR) pattern. No public exploit or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and wide availability of Author-level accounts in multi-contributor WordPress environments elevate real-world risk above what the CVSS 4.3 score alone suggests.
Stored cross-site scripting in the Meow Lightbox WordPress plugin, affecting all versions up to and including 5.6.4, lets an unauthenticated attacker save a crafted payload that executes JavaScript in the browser of any user who later views the injected page. Exploitation is heavily gated: the administrator must have enabled Output Buffering, selected the HtmlDomParser engine and enabled Aggressive Resolve, and the site must additionally expose a stored-HTML submission surface (the description cites anonymous bbPress replies) whose kses allow-list still preserves img attributes. Where those conditions are met a single unauthenticated submission is sufficient; no public exploit code and no CISA KEV entry were identified at time of analysis, and the issue is fixed in version 5.6.5.
Unauthenticated attackers can register an OAuth client with an attacker-controlled redirect URI against the AI Engine WordPress plugin's MCP OAuth 2.1 Dynamic Client Registration endpoint in all versions through 3.8.6, then obtain an administrator-bound MCP access token once an administrator approves the client on the OAuth consent screen - approval that can be obtained via clickjacking because the consent page lacks X-Frame-Options and CSP frame-ancestors. The flaw is CWE-862 missing authorization, caused by the register endpoint being exposed with a permission_callback of __return_true, and it is fixed in 3.8.7. Exploitation requires the opt-in MCP labs module to be active and administrator interaction (UI:R); no public exploit code and no CISA KEV entry are identified in the available data, and this is a high-severity, approval-gated issue rather than a drop-everything emergency.
Stored cross-site scripting in the AI Engine - The Chatbot, AI Framework & MCP for WordPress plugin (versions up to and including 3.8.0) lets an unauthenticated attacker plant script payloads that execute in a WordPress site's admin dashboard. The attack chains a denylist bypass on the /mwai-ui/v1/chats/submit REST endpoint into the plugin's own PHP error-log parser, which returns the forged log line as recent PHP-error content that the Advisor task then feeds verbatim into the AI prompt (CWE-1427 indirect prompt injection); the unvalidated AI response is saved to the mwai_advisor_data option and rendered by the Advisor dashboard widget without escaping. Exploitation is conditional - the Advisor task, its error-log ingestion, and the non-streaming/non-admin catch branch must all be in play, and the payload only fires when an authenticated administrator opens the dashboard and the Advisor widget renders - which is why the independent assessment scores it UI:R despite the PR:N injection path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing.
Cross-Site Request Forgery in AI Engine plugin (all versions ≤ 3.6.5) enables unauthenticated attackers to create new WordPress administrator accounts by tricking a logged-in site admin into clicking a crafted link. The attack exploits missing nonce validation on the `reauth_for_authorize` function in `labs/mcp-oauth.php`, combined with WordPress's built-in `?_method=POST` method-override feature to convert an innocuous-looking GET navigation request into an authenticated POST to the REST `/users` endpoint - no attacker account required. No public exploit has been identified at time of analysis, but the attack primitive is straightforward and the impact (full site takeover) is severe.
Authenticated attackers can escalate privileges to Administrator in AI Engine WordPress plugin version 3.4.9 through improper authorization in the MCP OAuth bearer-token implementation. The plugin accepts any valid OAuth token for Model Context Protocol (MCP) access without verifying administrator privileges, allowing low-privileged users (Subscriber+) to execute admin-level MCP tools. No public exploit or active exploitation identified at time of analysis.
Stored cross-site scripting in the Meow Gallery WordPress plugin (all versions up to and including 5.5.1) lets an authenticated author-level user inject script through attachment alt text that is emitted into an aria-label attribute. Because WordPress's sanitize_text_field() strips angle-bracketed tags but leaves double quotes intact, an attacker can break out of the aria-label context and add event-handler attributes such as onclick that fire when a visitor views the injected gallery page. The vulnerable sink is only reached when gallery items are rendered as links (a non-empty link_href), and a patch appears in the 5.5.1-to-5.5.2 changeset; no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_month rather than immediate action.
Arbitrary deletion of WordPress core database tables is possible through the Database Cleaner plugin in all versions up to and including 1.4.7, because the plugin's table-deletion REST endpoint does not restrict which tables may be targeted. Rated CVSS 8.7 with a scope change (C:N/I:H/A:H), the flaw nonetheless requires the attacker to already hold Administrator-level credentials, so realistic risk is confined to sites with multiple, delegated, or potentially compromised admin accounts rather than default single-admin deployments. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; priority is this_week rather than emergency.
Authorization bypass in the Meow Gallery plugin for WordPress, in all versions up to and including 5.5.4, lets any authenticated user holding author-level access or higher enumerate and read metadata - post ID, title, date, author and status - for every private and draft post on the site, including unpublished content belonging to other users. The root cause is a missing capability check on the plugin's REST handlers and core class (CWE-862), reachable remotely with PR:L and no user interaction against default configurations. Wordfence rates the issue 6.5, while our assessment narrows the confidentiality impact to metadata disclosure rather than post body content; no public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Limited arbitrary media file deletion affects the WordPress plugin AI Engine - MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini in all versions up to and including 3.8.4. An authenticated attacker holding only subscriber-level access can abuse insufficient path validation in the plugin's upload_file function to target media files outside the intended upload location, but three prerequisites must align: the administrator must have explicitly enabled the plugin's non-default Public API option, and the plugin's scheduled hourly cleanup_files task must run after the malicious upload before the deletion takes effect. Wordfence rates this Medium (CVSS 4.2, AC:H) with impact limited to integrity and availability of media files and no confidentiality exposure; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Stored cross-site scripting in the Meow Lightbox WordPress plugin (all versions up to and including 5.6.2) allows an authenticated subscriber-level user to inject arbitrary script through the 'display_name + comment' parameter, which then executes in the browser of any user viewing the injected page. Real-world risk is substantially lower than the 6.4 headline score suggests because three preconditions must all be met: the plugin's Output Buffering option must be explicitly enabled (it is disabled by default), the attacker must already have at least one approved comment on the site so that WordPress core auto-approves subsequent submissions, and any authenticated account (PR:L) is required - making default installations non-exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or CISA KEV signal is present in the available intelligence.
Insecure Direct Object Reference in the AI Engine WordPress plugin (tigroumeow, versions ≤3.7.7) allows authenticated subscribers to retrieve transcribed text from private audio attachments owned by any WordPress user, including site administrators. The `mediaId` REST API parameter accepts user-supplied attachment IDs without verifying the requester's ownership or access rights, enabling systematic enumeration of sequential WordPress attachment IDs. Exploitation is configuration-gated - the Public API module must be enabled - and no KEV listing or confirmed public exploit code exists at time of analysis.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.
Remote code execution in the Code Engine WordPress plugin (all versions ≤ 0.3.5) lets authenticated users with Contributor-level access or higher run arbitrary PHP/code on the server via the 'code-engine' shortcode, because the plugin fails to restrict access to its code-injection functionality. Reported by Wordfence, the flaw carries a CVSS 8.8 (high) rating; there is no public exploit identified at time of analysis, though the technique (abusing a shortcode that intentionally executes snippets) is straightforward for anyone with authoring rights. This turns the plugin's core 'run PHP snippets' feature into a privilege-escalation path from low-trust content contributors to full server code execution.
Meow Gallery plugin for WordPress (all versions through 5.4.4) exposes an unprotected REST API endpoint that permits any authenticated user with Author-level access or above to overwrite or create arbitrary gallery shortcode records by supplying a user-controlled `id` parameter. The endpoint `/wp-json/meow-gallery/v1/save_shortcode` performs direct database write operations without verifying ownership of the referenced record, making this a classic CWE-639 (IDOR) pattern. No public exploit or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and wide availability of Author-level accounts in multi-contributor WordPress environments elevate real-world risk above what the CVSS 4.3 score alone suggests.