Known vulnerabilities in AI Engine – The Chatbot, AI Framework & MCP for WordPress

AI meets WordPress. Your site can now chat, write poetry, solve problems, and maybe make you coffee.

34Reported vulnerabilities

9.8Highest CVSS score

3.7.1Latest version

100,000+Active installs

What to do now

Update AI Engine – The Chatbot, AI Framework & MCP for WordPress to 3.7.2 or later. 34 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2025-11749	Critical 9.8	74.8%	0 to 3.1.3 (inclusive)	`3.1.4`	November 5, 2025
CVE-2023-51409	Critical 9.8	63.1%	1.9.98 and earlier	`1.9.99`	January 9, 2024
CVE-2024-6451	High 7.2	0.8%	Before 2.4.3	`2.4.3`	August 19, 2024
CVE-2024-10499	High 7.2	0.6%	Before 2.6.5	`2.6.5`	December 12, 2024
CVE-2024-34440	Critical 9.1	0.8%	2.2.63 and earlier	`2.2.70`	May 7, 2024
CVE-2025-7847	High 8.8	1.1%	2.9.3 to 2.9.4 (inclusive)	`2.9.5`	July 31, 2025
CVE-2026-8719	High 8.8	0.4%	3.4.9 to 3.4.9 (inclusive)	`3.5.0`	May 17, 2026
CVE-2025-5071	High 8.8	0.7%	2.8.0 up to (but not including) 2.8.4	`2.8.4`	June 19, 2025
CVE-2023-2580	Medium 4.8	0.5%	Before 1.6.83	`1.6.83`	June 27, 2023
CVE-2026-15988	High 8.8	0.2%	0 to 3.6.5 (inclusive)	`3.6.6`	August 1, 2026
CVE-2024-6723	Medium 4.7	0.4%	Before 2.4.8	`2.4.8`	September 13, 2024
CVE-2025-6238	High 8	0.3%	2.8.4 to 2.8.4 (inclusive)	`2.8.5`	July 4, 2025
CVE-2024-0699	High 7.2	1.2%	2.1.4 and earlier	`2.1.5`	February 5, 2024
CVE-2026-12511	High 7.2	0.3%	3.5.4 and earlier	`3.5.5`	June 23, 2026
CVE-2026-27407	High 7.2	0.4%	3.4.9 and earlier	`3.5.0`	May 28, 2026
CVE-2026-23802	High 7.2	0.5%	3.3.2 and earlier	`3.3.3`	February 25, 2026
CVE-2026-1400	High 7.2	0.7%	0 to 3.3.2 (inclusive)	`3.3.3`	January 28, 2026
CVE-2026-65545	High 7.2	0.2%	3.6.8 and earlier	`3.6.9`	July 28, 2026
CVE-2025-12844	High 7.1	0.4%	3.1.8 and earlier	`3.1.9`	November 12, 2025
CVE-2025-8084	Medium 6.8	0.4%	0 to 3.1.8 (inclusive)	`3.1.9`	November 18, 2025
CVE-2025-7780	Medium 6.5	0.5%	0 to 2.9.4 (inclusive)	`2.9.5`	July 24, 2025
CVE-2024-29090	Medium 6.4	0.9%	2.1.4 and earlier	`2.1.5`	March 26, 2024
CVE-2026-75797	Medium 6.5	0.4%	3.3.3 to 3.7.1 (inclusive)	`3.7.2`	August 27, 2026
CVE-2026-16955	Medium 6.5	0.2%	3.6.5 and earlier	`3.6.6`	August 3, 2026
CVE-2025-8268	Medium 6.5	0.3%	0 to 2.9.5 (inclusive)	`2.9.6`	September 3, 2025
CVE-2026-0746	Medium 6.4	0.2%	0 to 3.3.2 (inclusive)	`3.3.3`	January 27, 2026
CVE-2024-38791	Medium 6.4	0.2%	2.4.7 and earlier	`2.4.8`	July 22, 2024
CVE-2024-0378	Medium 6.1	0.6%	Before 2.2.1	`2.2.1`	March 2, 2024
CVE-2026-75798	Medium 5.3	0.2%	3.4.0 to 3.7.1 (inclusive)	`3.7.2`	August 28, 2026
CVE-2026-16953	Medium 5.3	0.2%	3.6.3 and earlier	`3.6.4`	August 3, 2026
CVE-2025-5570	Medium 5.4	0.2%	Before 2.8.5	`2.8.5`	July 8, 2025
CVE-2026-75796	Medium 4.7	0.3%	3.6.0 and earlier	`3.6.1`	August 24, 2026
CVE-2026-12510	Medium 4.3	0.2%	3.5.4 and earlier	`3.5.5`	June 25, 2026
CVE-2026-16954	Low 2.7	0.2%	3.6.3 and earlier	`3.6.4`	July 30, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.