Tigroumeow vulnerabilities
33 CVEs and advisories name Tigroumeow as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-120575Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
- CVE-2026-120552SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in…
- CVE-2025-11455Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
- CVE-2026-109234Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
- CVE-2026-9239Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
- CVE-2025-8574Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
- CVE-2026-13747Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
- CVE-2026-110732AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via…
- CVE-2026-107745AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
- CVE-2026-107770Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
- CVE-2026-107757Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
- CVE-2026-107756Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
- CVE-2026-96561AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
- CVE-2026-89141AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
- CVE-2026-15988AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
- CVE-2026-4912Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
- CVE-2025-6784Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution
- CVE-2026-1291Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation
- CVE-2026-8719AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
- CVE-2026-1400AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
- CVE-2026-0746AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2025-8084AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
- CVE-2025-12844AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
- CVE-2025-11749AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
- CVE-2025-8268Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion
- CVE-2025-7847AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2025-7780AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
- CVE-2025-5570AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
- CVE-2025-6238AI Engine 2.8.4 - Insecure OAuth Implementation
- CVE-2025-5071AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP