CVE-2024-0378: medium-severity vulnerability in tigroumeow AI Engine – The Chatbot, AI…
AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.6%
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Related CVEs — tigroumeow AI Engine – The Chatbot, AI…
In the same product, most dangerous first.
CVE-2025-11749CRITICALAI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS 74.8%CVE-2024-0699MEDIUMAI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_urlEPSS 1.2%CVE-2026-1400HIGHAI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata EndpointEPSS 0.7%CVE-2025-7780MEDIUMAI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio FunctionsEPSS 0.6%CVE-2026-89141MEDIUMAI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' ParameterEPSS 0.5%CVE-2025-8084MEDIUMAI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request ForgeryEPSS 0.5%