AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 8, 2026
CVE-2026-14224: Easy Appointments <= 3.12.26 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-14224 affects the Easy Appointments plugin (up to version 3.12.26) with a medium severity CVSS score of 4.3. Authenticated attackers can manipulate appointment statuses; users should upgrade to version 3.12.27 to mitigate this...
August 8, 2026
CVE-2026-65545: AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.8 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65545 affects the Ai Engine plugin (up to v3.6.8) with a high severity CVSS score of 7.2 due to stored XSS vulnerabilities. Upgrade to v3.6.9 to mitigate risks of unauthorized script injection.
August 8, 2026
CVE-2026-66688: Ultimate Addons for Elementor <= 1.45.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66688 affects the Ultimate Addons for Elementor plugin (up to version 1.45.2) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, so patching is essential.
August 8, 2026
CVE-2026-61959: Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.24 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-61959 affects the Business Directory Plugin (up to version 6.4.24) with a medium severity CVSS score of 6.4. Patch to version 6.4.25 to mitigate the risk of stored cross-site scripting attacks.
August 8, 2026
CVE-2026-65553: Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 Unauthenticated Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-65553 affects the Spider Analyser plugin for WordPress (up to v2.1.3) with a critical CVSS score of 9.8. Unauthenticated attackers can execute remote code, highlighting the need for immediate patching.
August 8, 2026
CVE-2026-66703: MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66703 affects the MailOptin plugin (up to v1.2.78.0) with a CVSS score of 6.4. Authenticated attackers can exploit a Stored XSS vulnerability. Update to v1.2.78.1 to mitigate risks.
August 8, 2026
CVE-2026-65554: AnsPress – Question and answer 4.4.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65554 affects the AnsPress Question Answer plugin (up to version 4.4.4) with a medium severity CVSS score of 4.3. Ensure to patch to prevent unauthorized actions by authenticated users.
August 8, 2026
CVE-2026-65507: AI Copilot – Content Generator <= 1.5.6 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-65507 affects the Ai Copilot Content Generator plugin (up to v1.5.6) with a critical CVSS score of 9.8, allowing unauthenticated privilege escalation. Upgrade to v1.5.8 to mitigate this risk.
August 8, 2026
CVE-2026-65549: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 Authenticated (Author+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-65549 affects the Jeg Elementor Kit plugin (up to version 3.2.10) with a high severity CVSS score of 7.5. Authenticated attackers can exploit a PHP Object Injection vulnerability. Upgrade to version 3.2.11 to mitigate risks.
August 8, 2026
CVE-2026-65502: Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.7.13 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65502 affects the Bdthemes Element Pack Lite plugin (up to version 8.7.13) with a medium severity score of 5.3. Unauthenticated attackers can exploit this vulnerability, so ensure you update to the patched version.
August 8, 2026
CVE-2026-65509: wpDataTables (Premium) <= 7.5.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65509 affects the wpDataTables plugin (up to version 7.5.1) with a high severity CVSS score of 7.2. Unauthenticated attackers can exploit this stored XSS vulnerability, emphasizing the need for immediate patching.
August 8, 2026
CVE-2026-65508: Simply Schedule Appointments <= 1.6.12.10 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65508 affects the Simply Schedule Appointments plugin (up to 1.6.12.10) with a high severity SQL injection vulnerability (CVSS 7.5). Update to version 1.6.12.11 to mitigate risks of data exposure.
August 8, 2026
CVE-2026-65517: Easy PayPal & Stripe Buy Now Button <= 2.0.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65517 affects Wp Ecommerce Paypal plugin versions up to 2.0.4, with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts. Update to version 2.0.5 to mitigate risks.
August 8, 2026
CVE-2026-65542: Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65542 affects the Super Socializer plugin (up to v7.14.5) with a medium severity (CVSS 5.3) vulnerability. Unauthenticated attackers can exploit this issue; ensure to patch to mitigate risks.
August 8, 2026
CVE-2026-65544: Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65544 affects the Super Socializer plugin (up to version 7.14.5) with a CVSS score of 7.2. This high-severity XSS vulnerability allows unauthenticated attackers to inject scripts. Ensure you update to the patched version.
August 8, 2026
CVE-2026-65551: Breakdance <= 2.6.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65551 affects the Breakdance plugin for WordPress (up to version 2.6.1) with a medium severity CVSS of 5.3. It allows unauthorized access; users should update to the patched version to mitigate risks.
August 7, 2026
CVE-2026-13344: Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-13344 affects the Essential Addons for Elementor Lite plugin, allowing authenticated users to inject scripts due to a stored XSS vulnerability. Update to version 6.6.10 to mitigate this medium severity issue.
August 7, 2026
CVE-2026-15054: Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 Missing Authorization to Unauthenticated Unauthorized Form Submission PoC, Patch Analysis & Rule
CVE-2026-15054 affects the Bit Form plugin (up to version 3.1.2) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability to submit restricted forms. Update to the patched version to mitigate risks.
August 7, 2026
CVE-2026-14526: AI Copilot – Content Generator <= 1.5.6 Unauthenticated Privilege Escalation via Custom Workflow Route PoC, Patch Analysis & Rule
CVE-2026-14526 affects the Ai Copilot Content Generator plugin for WordPress (up to v1.5.6) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this to create admin accounts. Patch immediately.
August 7, 2026
CVE-2026-18988: Easy Accordion <= 3.1.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute PoC, Patch Analysis & Rule
CVE-2026-18988 affects the Easy Accordion Free plugin (up to v3.1.8) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to v3.1.9 to mitigate risks from potential script injections.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.