Ai Auto Tool Vulnerabilities

[en] The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.2.6. This makes it possible for authenticated attackers, with Subscriber-...

Affected:

up to 2.0.7

Fix:

No patched version reported

Disclosed:

Nov 4, 2025

CVE-2025-12156 on NVD →

The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_post_data() function in versions 2.0.7 to 2.3.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVSS:

4.3

Affected:

2.0.7 – 2.3.0

Fix:

No patched version reported

Disclosed:

Nov 3, 2025

CVE-2025-12156 on NVD →

The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary loc...

CVSS:

6.4

Affected:

up to 2.3.9

Fixed in:

2.4.0

Disclosed:

Sep 5, 2025

CVE-2025-58829 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One allows Server Side Request Forgery. This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through 2.2.6.

Affected:

up to 2.2.6

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58829 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One allows Blind SQL Injection. This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n...

Affected:

up to 2.1.8

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31564 on NVD →

The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVSS:

6.5

Affected:

up to 2.2.7

Fixed in:

2.2.8

Disclosed:

Mar 31, 2025

CVE-2025-31564 on NVD →

[en] Missing Authorization vulnerability in KCT Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through 2.1.2.

Affected:

up to 2.1.3

Fixed in:

2.1.3

Disclosed:

Nov 14, 2024

CVE-2024-52383 on NVD →

The Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete post revi...

CVSS:

5.3

Affected:

up to 2.1.2

Fixed in:

2.1.3

Disclosed:

Nov 11, 2024

CVE-2024-52383 on NVD →