tigroumeow vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20259
3. 202621

Newest CVEs

• CVE-2026-120575

  Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name

  tigroumeow · Photo Engine (Media Organizer & Lightroom)

  Medium6.4
• CVE-2026-120552

  SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()

  tigroumeow · SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress

  Medium6.4
• CVE-2025-11455

  Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement

  tigroumeow · Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF

  Medium4.3
• CVE-2026-109234

  Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

  tigroumeow · Meow Lightbox

  High7.2
• CVE-2026-9239

  Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

  tigroumeow · Meow Gallery

  Medium6.4
• CVE-2025-8574

  Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion

  tigroumeow · Database Cleaner: Cleanup, Optimization & Repair

  High8.7
• CVE-2026-13747

  Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint

  tigroumeow · Meow Gallery

  Medium6.5
• CVE-2026-110732

  AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration

  tigroumeow · AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini

  High7.5
• CVE-2026-107745

  AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter

  tigroumeow · AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini

  Medium4.2
• CVE-2026-107770

  Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

  tigroumeow · Photo Engine (Media Organizer & Lightroom)

  Medium6.8