WordPress plugin
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High3
- Medium8
- Low2
All AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts ≤1.8.96Update to 1.8.97 | CVE-2025-0428 | |
| High7.2 | Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms ≤1.8.96Update to 1.8.97 | CVE-2025-0429 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤1.8.89Update to 1.8.90 | CVE-2024-10392 | |
| High8.1 | Missing Authorization ≤1.4.37Update to 1.4.38 | CVE-2023-0405 |
- High7.2Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts
≤1.8.96Update to 1.8.97
- High7.2Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
≤1.8.96Update to 1.8.97
- Critical9.8Unauthenticated Arbitrary File Upload
≤1.8.89Update to 1.8.90
- High8.1Missing Authorization
≤1.4.37Update to 1.4.38
AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot: common questions
Does AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot: 1 critical, 3 high, 8 medium, 2 low. At least one is not fixed in the latest version.
How do I check which version of AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot vulnerability?
CVE-2026-104742, published Oct 9, 2026: AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action. Severity: Low (CVSS 3.1).
Is any AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot vulnerability listed in CISA KEV?
No. None of the known AI Puffer – MCP Server for Claude & ChatGPT, with AI Chatbot vulnerabilities is currently listed in the CISA KEV catalog.