Meowapps vulnerabilities
24 vulnerabilities
Known vulnerabilities in Meowapps products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
Products
8- Ai Engine13 vulnerabilities
- Database Cleaner2 vulnerabilities
- Media File Renamer Auto \& Manual Rename2 vulnerabilities
- Photo Engine2 vulnerabilities
- Wp Retina 2X2 vulnerabilities
- Media Usage1 vulnerabilities
- Meow Gallery1 vulnerabilities
- Perfect Images1 vulnerabilities
CVE-2018-20983meowappswp_retina_2x+1
EPSS score0.91%
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.CVE-2018-0511jordy meowwp retina 2x+2EPSS score0.90%
Cross-site scripting vulnerability in WP Retina 2x prior to version 5.2.2 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2021-36850meow appsmedia file renamer – auto & manual rename (wordpress plugin)+2EPSS score0.44%
Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state.CVE-2021-24465meowappsmeow_gallery+2EPSS score1.17%
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.CVE-2021-34652media usagemedia usage+2EPSS score0.84%
The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.CVE-2025-5570meowappsai_engine+2EPSS score0.20%
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-5071meowappsai_engine+2EPSS score0.67%
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.CVE-2025-6238meowappsai_engine+2EPSS score0.37%
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.CVE-2024-0699meowappsai_engine+2EPSS score1.21%
The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_image_from_url' function in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Editor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2024-29100 is likely a duplicate of this issue.CVE-2024-43332jordy meowphoto engine+2EPSS score0.55%
Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.CVE-2024-29090jordy meowai engine: chatgpt chatbot+2EPSS score0.89%
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.CVE-2024-29100jordy meowai engine: chatgpt chatbot+1EPSS score0.64%
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.CVE-2024-38791jordy meowai engine: chatgpt chatbot+2EPSS score0.22%
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.CVE-2024-10499meowappsai_engine+2EPSS score0.61%
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacksCVE-2024-6723meowappsai_engine+2EPSS score0.45%
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.CVE-2024-6451meowappsai_engine+2EPSS score0.82%
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.CVE-2024-34440jordy meowai engine: chatgpt chatbot+2EPSS score0.82%
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.CVE-2024-35712jordy meowdatabase cleaner+2EPSS score0.56%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5.CVE-2023-2580meowappsai_engine+2EPSS score0.47%
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).CVE-2023-51508jordy meowdatabase cleaner: clean, optimize & repair+2EPSS score0.48%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.