AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-27066: Live sales notification for WooCommerce <= 2.3.46 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27066 affects the Live Sales Notifications for WooCommerce plugin (up to v2.3.46) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity flaw. Upgrade to v2.3.47 to mitigate risks.
March 18, 2026
CVE-2026-27057: Penci Filter Everything <= 1.7 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27057 affects the Penci Filter Everything plugin for WordPress (up to v1.7) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure timely patching to mitigate risks.
March 18, 2026
CVE-2026-27058: Penci Podcast <= 1.7 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27058 affects the Penci Podcast plugin (up to version 1.7) with a medium severity CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so ensure timely patching or WAF coverage.
March 18, 2026
CVE-2025-69361: Post Expirator <= 4.9.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69361 affects the Post Expirator plugin (up to version 4.9.3) with a medium severity CVSS score of 4.3. Patch to version 4.9.4 to mitigate unauthorized access by authenticated users.
March 18, 2026
CVE-2026-27059: Penci Recipe <= 4.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27059 affects the Penci Recipe plugin for WordPress (up to version 4.1) with a medium severity CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so ensure you patch to mitigate risks.
March 18, 2026
CVE-2026-24392: HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.14.2 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24392 affects the HurryTimer plugin (up to 2.14.2) with a medium severity CVSS of 6.4. Authenticated users can exploit this stored XSS vulnerability, so update to version 2.14.3 to mitigate risks.
March 18, 2026
CVE-2026-24354: Penci Shortcodes & Performance <= 6.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24354 affects the Penci Shortcodes plugin (up to v6.1) with a CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, impacting site security. Ensure you update to the patched version.
March 18, 2026
CVE-2026-24967: Amelia <= 1.2.38 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24967 affects the Amelia booking plugin (versions
March 18, 2026
CVE-2026-24622: Suggestion Toolkit <= 5.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24622 affects the Suggestion Toolkit plugin for WordPress (up to v5.0) with a medium severity (CVSS 4.3). Authenticated users can exploit this flaw for unauthorized actions. Ensure you update to the patched version.
March 18, 2026
CVE-2026-24621: Terms descriptions <= 3.4.9 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24621 affects the Terms Descriptions plugin (up to version 3.4.9) with a medium severity (CVSS 4.4) stored XSS vulnerability. Update to 3.4.10 to mitigate risks from authenticated attacks in multi-site setups.
March 18, 2026
CVE-2026-24625: File Uploads Addon for WooCommerce <= 1.7.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24625 affects the Woo Addon Uploads plugin (v1.7.3) with a medium severity (CVSS 5.3) file upload vulnerability. Unauthenticated attackers can exploit this issue, so ensure you update to the patched version.
March 18, 2026
CVE-2026-24623: Neoforum <= 1.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24623 affects the Neoforum plugin for WordPress (version 1.0) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability; ensure timely patching to mitigate risks.
March 18, 2026
CVE-2026-24624: Neoforum <= 1.0 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-24624 affects the Neoforum plugin for WordPress (version 1.0) with a medium severity score of 4.9. Administrators should patch to mitigate SQL injection risks that could expose sensitive database information.
March 18, 2026
CVE-2026-24620: Landing Page Builder <= 1.5.3.4 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24620 affects the Page Builder Add plugin for WordPress (up to 1.5.3.4) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2026-24626: Logo Slider <= 4.9.0 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24626 affects the Logo Slider Wp plugin (up to v4.9.0) with a CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities. Ensure to update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24627: Trusona for WordPress <= 2.0.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24627 affects the Trusona plugin for WordPress (up to version 2.0.0) with a medium severity CVSS score of 4.3. Authenticated users can exploit this vulnerability to perform unauthorized actions, so patching is essential.
March 18, 2026
CVE-2026-24374: RegistrationMagic <= 6.0.6.9 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24374 affects the Custom Registration Form Builder With Submission Manager plugin (up to 6.0.6.9) with a medium severity CVSS of 4.3 due to Cross-Site Request Forgery. Update to version 6.0.7.0 to mitigate risks.
March 18, 2026
CVE-2025-69359: Creator LMS <= 1.1.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69359 affects the Creator LMS plugin (up to v1.1.12) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this to modify settings; update to v1.1.13 for protection.
March 18, 2026
CVE-2026-24966: Copyscape Premium <= 1.4.1 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24966 affects the Copyscape Premium plugin (up to v1.4.1) with a medium severity CVSS score of 4.3. It's crucial to update to v1.4.2 to mitigate Cross-Site Request Forgery risks that could allow unauthorized actions.
March 18, 2026
CVE-2025-66143: Crumber <= 1.0.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66143 affects the Crumber Elementor plugin (up to version 1.0.10) with a medium severity CVSS score of 4.3. Authenticated users can exploit this flaw for unauthorized actions; patching is recommended.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.