WordPress plugin
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 46 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High15
- Medium24
- Low4
All AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.9.1Update to 3.9.2
- High7.5Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
≤3.8.6Update to 3.8.7
- High7.2Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
≤3.8.0Update to 3.8.1
- High8.8Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
≤3.6.5Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.8Update to 3.6.9
- High7.2Authenticated (Editor+) Arbitrary File Write
≤3.5.4Update to 3.5.5
- High7.2Authenticated (Editor+) Privilege Escalation
≤3.4.9Update to 3.5.0
- High8.8Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
3.4.9 – 3.4.9Update to 3.5.0
- High7.2Authenticated (Editor+) Arbitrary File Upload
≤3.3.2Update to 3.3.3
- High7.2Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
≤3.3.2Update to 3.3.3
- High7.1Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
≤3.1.8Update to 3.1.9
- Critical9.8Unauthenticated Sensitive Information Exposure to Privilege Escalation
≤3.1.3Update to 3.1.4
- High8.82.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
2.9.3 – 2.9.4Update to 2.9.5
- High8.0Insecure OAuth Implementation
2.8.4 – 2.8.4Update to 2.8.5
- High8.82.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
2.8.0 – 2.8.3Update to 2.8.4
- High7.2Authenticated (Admin+) Remote Code Execution
≤2.5.0Update to 2.5.1
- Critical9.1Authenticated (Editor+) Arbitrary File Upload
≤2.2.63Update to 2.2.70
- Critical9.8Unauthenticated Arbitrary File Upload via rest_upload
≤1.9.98Update to 1.9.99
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini: common questions
Does AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini have known vulnerabilities?
Yes. VulnCrest Radar lists 46 known vulnerabilities in AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini: 3 critical, 15 high, 24 medium, 4 low. None are known to affect version null.
How do I check which version of AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini vulnerability?
CVE-2026-123478, published Nov 9, 2026: AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini <= 3.9.1 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini vulnerability listed in CISA KEV?
No. None of the known AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini vulnerabilities is currently listed in the CISA KEV catalog.