AI Engine – The Chatbot, AI Framework & MCP for WordPress

92 Quality Score

Active Installs

22/30

With 100,000 active installs and a popularity score of 75 out of 30, the plugin punches well above its weight and has clearly crossed into mainstream adoption for the AI-on-WordPress niche.

Update Freshness

25/25

The maintenance score is a perfect 100, backed by an update dated July 13, 2026 and tested against WordPress 7.0.1, which signals an actively maintained codebase.

User Rating

15/15

A 98 out of 100 from 846 reviewers is an unusually strong rating for a plugin this complex, indicating that most users who try it are happy enough to leave positive feedback.

Support Health

15/15

All 26 support threads are marked resolved, giving a perfect 100 support score, though the small absolute thread count means a single new ticket could move the needle.

WP Compatibility

15/15

Compatibility scores 100, with a stated minimum of WordPress 6.0 and PHP 7.4, which keeps it accessible to a very wide range of hosting environments.

Scores higher than 99% of indexed plugins

About

AI meets WordPress. Your site can now chat, write poetry, solve problems, and maybe make you coffee.

Active Installs 90k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-25 12:09pm GMT

Requires WordPress 6.0+

Tested Up To 7.1.2

Requires PHP 8.1+

Security History

35 known vulnerabilities, all patched

3 Critical 12 High 19 Medium 1 Low

Most recent: September 14, 2026

View details ▸

AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter Medium

September 14, 2026 Patched in ["3.7.8"] CVE-2026-89141

AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution Medium

August 28, 2026 Patched in ["3.7.2"] CVE-2026-75798

AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read Medium

August 27, 2026 Patched in ["3.7.2"] CVE-2026-75797

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation Medium

August 24, 2026 Patched in ["3.6.1"] CVE-2026-75796

AI Engine <= 3.6.3 - Insecure Direct Object Reference to Unauthenticated Cross-Session Chatbot File Deletion Medium

August 3, 2026 Patched in ["3.6.4"] CVE-2026-16953

AI Engine <= 3.6.5 - Authenticated (Subscriber+) Arbitrary File Read Medium

August 3, 2026 Patched in ["3.6.6"] CVE-2026-16955

AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match High

July 31, 2026 Patched in ["3.6.6"] CVE-2026-15988

AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure Low

July 30, 2026 Patched in ["3.6.4"] CVE-2026-16954

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting High

July 28, 2026 Patched in ["3.6.9"] CVE-2026-65545

AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure Medium

June 25, 2026 Patched in ["3.5.5"] CVE-2026-12510

AI Engine <= 3.5.4 - Authenticated (Editor+) Arbitrary File Write High

June 23, 2026 Patched in ["3.5.5"] CVE-2026-12511

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation High

May 28, 2026 Patched in ["3.5.0"] CVE-2026-27407

AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token High

May 16, 2026 Patched in ["3.5.0"] CVE-2026-8719

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload High

February 25, 2026 Patched in ["3.3.3"] CVE-2026-23802

AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint High

January 27, 2026 Patched in ["3.3.3"] CVE-2026-1400

AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery Medium

January 27, 2026 Patched in ["3.3.3"] CVE-2026-0746

AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery Medium

November 18, 2025 Patched in ["3.1.9"] CVE-2025-8084

AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization High

November 12, 2025 Patched in ["3.1.9"] CVE-2025-12844

AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation Critical

November 4, 2025 Patched in ["3.1.4"] CVE-2025-11749

Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion Medium

September 3, 2025 Patched in ["2.9.6"] CVE-2025-8268

AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload High

July 30, 2025 Patched in ["2.9.5"] CVE-2025-7847

AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions Medium

July 23, 2025 Patched in ["2.9.5"] CVE-2025-7780

AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter Medium

July 7, 2025 Patched in ["2.8.5"] CVE-2025-5570

AI Engine 2.8.4 - Insecure OAuth Implementation High

July 3, 2025 Patched in ["2.8.5"] CVE-2025-6238

AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP High

June 18, 2025 Patched in ["2.8.4"] CVE-2025-5071

AI Engine <= 2.6.3 - Authenticated (Admin+) SQL Injection Medium

November 21, 2024 Patched in ["2.6.5"] CVE-2024-10499

AI Engine <= 2.4.7 - Authenticated (Admin+) SQL Injection Medium

August 22, 2024 Patched in ["2.4.8"] CVE-2024-6723

AI Engine <= 2.5.0 - Authenticated (Admin+) Remote Code Execution High

July 29, 2024 Patched in ["2.5.1"] CVE-2024-6451

AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery Medium

July 22, 2024 Patched in ["2.4.8"] CVE-2024-38791

AI Engine: ChatGPT Chatbot <= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload Critical

May 7, 2024 Patched in ["2.2.70"] CVE-2024-34440

AI Engine <= 2.1.4 - Authenticated (Editor+) Server-Side Request Forgery Medium

March 26, 2024 Patched in ["2.1.5"] CVE-2024-29090

AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting Medium

March 1, 2024 Patched in ["2.2.1"] CVE-2024-0378

AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url Medium

January 18, 2024 Patched in ["2.1.5"] CVE-2024-0699

AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload Critical

January 9, 2024 Patched in ["1.9.99"] CVE-2023-51409

AI Engine: ChatGPT Chatbot, Content Generator, GPT 3 & 4, Ultra-Customizable <= 1.6.82 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

May 19, 2023 Patched in ["1.6.83"] CVE-2023-2580

What It Does

AI Engine connects your WordPress site to large language model APIs from providers such as OpenAI and Anthropic, letting you build chatbots, generate content, run AI-powered forms, and expose tools via the Model Context Protocol (MCP). It ships as a flexible framework rather than a single-purpose widget, so you can wire AI features into pages, admin screens, or custom workflows.

Who It's For

This plugin is built for site owners and developers who want a self-hosted hub for AI features on WordPress, including bloggers who want in-dashboard writing assistants, businesses deploying a branded chatbot, or tinkerers experimenting with MCP servers. It is especially useful if you already hold API keys for OpenAI, Claude, or similar providers and want a single plugin instead of several single-vendor add-ons.

Who Should Skip It

If you just need a polished live chat widget with a built-in AI agent and no API setup, tools like Tidio or Chatway will get you running in minutes. Likewise, anyone looking purely for AI-driven SEO content and keyword research will be better served by GetGenie or All in One SEO.

The Bottom Line

AI Engine is one of the most capable and best-rated AI frameworks available for WordPress right now, scoring 92.09 out of 100 with strong maintenance, compatibility, and user satisfaction. Its main limitation is that it is a power-user toolkit: you will need your own API keys, a tolerance for configuration screens, and some comfort with concepts like MCP to get the most out of it. For developers and AI-curious site owners it is an easy recommendation; for anyone wanting a one-click chat widget, look at the lighter alternatives above.

Pick this if your primary AI need is SEO titles, schema, and content suggestions rather than chatbots or MCP-driven agents.

Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons 90/100

Choose Chatway when you want a turnkey customer-support chat widget with AI baked in and zero API configuration.

Website LLMs.txt 85/100

Go with Website LLMs.txt if your only goal is making your content crawlable for external AI models and LLMs.

GetGenie – AI Content Writer with Keyword Research & SEO Tracking 84/100

Pick GetGenie when you want AI writing plus SERP and keyword research tightly integrated into the WordPress editor.

Tidio – Live Chat & AI Chatbots 84/100

Pick Tidio if you want a hosted live chat and chatbot SaaS with built-in AI rather than bringing your own OpenAI or Claude key.

AI Engine – The Chatbot, AI Framework & MCP for WordPress

About

Security History

What It Does

Who It's For

Who Should Skip It

The Bottom Line

Related Plugins

Tags