# cve.now: Tigroumeow

The newest entries naming Tigroumeow as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120575](https://cve.now/CVE-2026-120575.md): Photo Engine (Media Organizer & Lightroom) \<= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name (CVSS 6.4)
- [CVE-2026-120552](https://cve.now/CVE-2026-120552.md): SEO Engine \<= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in… (CVSS 6.4)
- [CVE-2025-11455](https://cve.now/CVE-2025-11455.md): Perfect Images \<= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement (CVSS 4.3)
- [CVE-2026-109234](https://cve.now/CVE-2026-109234.md): Meow Lightbox \<= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization (CVSS 7.2)
- [CVE-2026-9239](https://cve.now/CVE-2026-9239.md): Meow Gallery \<= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) (CVSS 6.4)
- [CVE-2025-8574](https://cve.now/CVE-2025-8574.md): Database Cleaner \<= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion (CVSS 8.7)
- [CVE-2026-13747](https://cve.now/CVE-2026-13747.md): Meow Gallery \<= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch\_posts REST Endpoint (CVSS 6.5)
- [CVE-2026-110732](https://cve.now/CVE-2026-110732.md): AI Engine – The Chatbot, AI Framework & MCP for WordPress \<= 3.8.6 - Missing Authorization to Administrator Account Takeover via… (CVSS 7.5)
- [CVE-2026-107745](https://cve.now/CVE-2026-107745.md): AI Engine \<= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter (CVSS 4.2)
- [CVE-2026-107770](https://cve.now/CVE-2026-107770.md): Photo Engine (Media Organizer & Lightroom) \<= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action (CVSS 6.8)
- [CVE-2026-107757](https://cve.now/CVE-2026-107757.md): Gallery Custom Links \<= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body (CVSS 4.9)
- [CVE-2026-107756](https://cve.now/CVE-2026-107756.md): Meow Lightbox \<= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display\_name (CVSS 6.4)
- [CVE-2026-96561](https://cve.now/CVE-2026-96561.md): AI Engine \<= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model\_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection (CVSS 7.2)
- [CVE-2026-89141](https://cve.now/CVE-2026-89141.md): AI Engine \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter (CVSS 6.5)
- [CVE-2026-15988](https://cve.now/CVE-2026-15988.md): AI Engine \<= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST\_URI Substring Match (CVSS 8.8)
- [CVE-2026-4912](https://cve.now/CVE-2026-4912.md): Media Cleaner: Clean your WordPress! \<= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 4.1)
- [CVE-2025-6784](https://cve.now/CVE-2025-6784.md): Code Engine \<= 0.3.5 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8)
- [CVE-2026-1291](https://cve.now/CVE-2026-1291.md): Meow Gallery \<= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation (CVSS 4.3)
- [CVE-2026-8719](https://cve.now/CVE-2026-8719.md): AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token (CVSS 8.8)
- [CVE-2026-1400](https://cve.now/CVE-2026-1400.md): AI Engine \<= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update\_media\_metadata Endpoint (CVSS 7.2)
- [CVE-2026-0746](https://cve.now/CVE-2026-0746.md): AI Engine \<= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4)
- [CVE-2025-8084](https://cve.now/CVE-2025-8084.md): AI Engine \<= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery (CVSS 6.8)
- [CVE-2025-12844](https://cve.now/CVE-2025-12844.md): AI Engine \<= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization (CVSS 7.1)
- [CVE-2025-11749](https://cve.now/CVE-2025-11749.md): AI Engine \<= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation (CVSS 9.8)
- [CVE-2025-8268](https://cve.now/CVE-2025-8268.md): Ai Engine \<= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion (CVSS 6.5)
- [CVE-2025-7847](https://cve.now/CVE-2025-7847.md): AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-7780](https://cve.now/CVE-2025-7780.md): AI Engine \<= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get\_audio Functions (CVSS 6.5)
- [CVE-2025-5570](https://cve.now/CVE-2025-5570.md): AI Engine \<= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \`mwai\_chatbot\` Shortcode \`id\` Parameter (CVSS 5.4)
- [CVE-2025-6238](https://cve.now/CVE-2025-6238.md): AI Engine 2.8.4 - Insecure OAuth Implementation (CVSS 8.0)
- [CVE-2025-5071](https://cve.now/CVE-2025-5071.md): AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP (CVSS 8.8)
- [CVE-2024-4386](https://cve.now/CVE-2024-4386.md): Gallery Block (Meow Gallery) \<= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-0378](https://cve.now/CVE-2024-0378.md): AI Engine \<= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5)
- [CVE-2024-0699](https://cve.now/CVE-2024-0699.md): AI Engine \<= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add\_image\_from\_url (CVSS 6.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tigroumeow
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.