tigroumeow vulnerabilities
33 published CVEs name tigroumeow among the affected products.
- 33Published CVEs33 of them scored
- 22Last 12 monthspublished in the last year
- 1Critical12 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-120575
Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
tigroumeow · Photo Engine (Media Organizer & Lightroom)
Medium6.4 - CVE-2026-120552
SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
tigroumeow · SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress
Medium6.4 - CVE-2025-11455
Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
tigroumeow · Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
Medium4.3 - CVE-2026-109234
Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
tigroumeow · Meow Lightbox
High7.2 - CVE-2026-9239
Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
tigroumeow · Meow Gallery
Medium6.4 - CVE-2025-8574
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
tigroumeow · Database Cleaner: Cleanup, Optimization & Repair
High8.7 - CVE-2026-13747
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
tigroumeow · Meow Gallery
Medium6.5 - CVE-2026-110732
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
tigroumeow · AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
High7.5 - CVE-2026-107745
AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
tigroumeow · AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
Medium4.2 - CVE-2026-107770
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
tigroumeow · Photo Engine (Media Organizer & Lightroom)
Medium6.8