Tigroumeow
Vulnerability activity for Tigroumeow: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 12
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 13
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 13
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.4MediumNov 3, 2026Tigroumeow Photo Engine (Media Organizer & Lightroom) XSSCVE-2026-120575The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wpl
- 6.4MediumNov 3, 2026Tigroumeow SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress XSSCVE-2026-120552The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (appli
- 4.3MediumOct 31, 2026Tigroumeow Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF Auth bypass / access controlCVE-2025-11455The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.
- 7.2HighOct 31, 2026Tigroumeow Meow Lightbox XSSCVE-2026-109234The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggress
- 6.4MediumOct 30, 2026Tigroumeow Meow Gallery XSSCVE-2026-9239The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered a
- 6.5MediumOct 30, 2026Tigroumeow Meow Gallery Auth bypass / access controlCVE-2026-13747The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.
- 8.7HighOct 30, 2026Tigroumeow Database Cleaner: Cleanup, Optimization & Repair Auth bypass / access controlCVE-2025-8574The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.
- 7.5HighOct 30, 2026Tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini Auth bypass / access controlCVE-2026-110732The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attacke
- 4.2MediumOct 28, 2026Tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini Path traversal / file handlingCVE-2026-107745The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media files on the server. This requires the administrator to have enabled the Public API option, and exploitation depends on the hourly cleanup_fi
- 6.8MediumOct 16, 2026Tigroumeow Photo Engine (Media Organizer & Lightroom) Auth bypass / access controlCVE-2026-107770The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary media attachments via wp_delete_attachment and upload new attachments to the site, actions that require the upload_files or edit_others_posts capabilities. A Subscriber
- 4.9MediumOct 14, 2026Tigroumeow Gallery Custom Links XSSCVE-2026-107757The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordi
- 6.4MediumOct 14, 2026Tigroumeow Meow Lightbox XSSCVE-2026-107756The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering o
- 6.5MediumSep 15, 2026Tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress Auth bypass / access controlCVE-2026-89141The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to access and retrieve the transcribed contents of private audio attachments belonging to other users, including Administrators, via a supplied attachm
Top products
- Photo Engine (Media Organizer & Lightroom)2 CVEs in the last year
- Meow Lightbox2 CVEs in the last year
- Meow Gallery2 CVEs in the last year
- AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini2 CVEs in the last year
- SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress1 CVE in the last year
- Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF1 CVE in the last year
- Gallery Custom Links1 CVE in the last year
- Database Cleaner: Cleanup, Optimization & Repair1 CVE in the last year
- AI Engine – The Chatbot, AI Framework & MCP for WordPress1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.