Unknown Ai Engine vulnerabilities

10 CVEs affecting Unknown Ai Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111041, published 2026-10-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12511, published 2026-07-14. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write…
CVE-2026-75796, published 2026-08-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing…
CVE-2026-75797, published 2026-08-26. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external…
CVE-2026-16954, published 2026-08-06. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the…
CVE-2026-16955, published 2026-08-08. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level…
CVE-2026-75798, published 2026-08-26. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors,…
CVE-2026-16953, published 2026-08-08. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so…
CVE-2026-12510, published 2026-07-16. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read…
CVE-2026-111041, published 2026-10-18. The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with…
CVE-2026-110976, published 2026-10-18. The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently…