AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 7, 2026
CVE-2026-15257: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-15257 affects the Custom Registration Form Builder With Submission Manager plugin for WordPress, allowing unauthorized access in version 6.0.9.4. Update to the patched version to mitigate this medium severity vulnerability.
August 7, 2026
CVE-2026-13330: Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates < 2.7.0 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-13330 affects the Animation Addons for Elementor plugin (up to v2.7.0) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Update to v2.7.0 to mitigate risks from authenticated attackers injecting malicious scripts.
August 7, 2026
CVE-2026-15153: WP Hotel Booking < 2.3.2 Authenticated (Custom role+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-15153 affects the WP Hotel Booking plugin (up to version 2.3.2) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit SQL injection vulnerabilities, so ensure timely patching to protect sensitive data.
August 7, 2026
CVE-2026-15255: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-15255 affects the Custom Registration Form Builder With Submission Manager plugin for WordPress, allowing unauthorized actions due to an IDOR vulnerability. Update to version 6.0.9.4 to mitigate this medium-severity issue.
August 7, 2026
CVE-2026-14188: Easy Appointments <= 3.12.26 Authenticated (Contributor+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-14188 affects the Easy Appointments plugin for WordPress (up to version 3.12.26) with a medium severity CVSS score of 4.3. Authenticated users can cancel others' appointments; update to version 3.12.27 to mitigate.
August 7, 2026
CVE-2026-14222: Easy Appointments <= 3.12.26 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-14222 affects the Easy Appointments plugin (up to v3.12.26) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Users should update to v3.12.27 to mitigate risks.
August 7, 2026
CVE-2026-13145: WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-13145 affects WP Travel plugin versions up to 11.8.1, allowing authenticated users to access others' booking records due to an Insecure Direct Object Reference. Update to the patched version to mitigate this medium severity risk.
August 7, 2026
CVE-2026-14226: Easy Appointments <= 3.12.26 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-14226 affects the Easy Appointments plugin (up to 3.12.26) with a medium severity (CVSS 4.3) vulnerability, allowing authenticated users to access sensitive data. Update to version 3.12.27 to mitigate this risk.
August 7, 2026
CVE-2026-14223: Easy Appointments <= 3.12.26 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-14223 affects Easy Appointments plugin version 3.12.26 and earlier, allowing authenticated users to cancel others' appointments. Upgrade to 3.12.27 to mitigate this medium severity vulnerability.
August 7, 2026
CVE-2026-14221: Easy Appointments <= 3.12.26 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-14221 affects the Easy Appointments plugin for WordPress (up to v3.12.26) with a medium severity (CVSS 4.3) vulnerability. Patch to v3.12.27 to mitigate unauthorized access risks.
August 7, 2026
CVE-2026-14318: GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 Authenticated (Custom role+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-14318 affects the GiveWP Donation Plugin (up to version 4.16.3) with a medium severity XSS vulnerability. Ensure you update to the patched version to mitigate risks from authenticated attackers.
August 7, 2026
CVE-2026-14923: Sync Post With Other Site < 1.9.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-14923 affects the Sync Post With Other Site plugin for WordPress (up to v1.9.3) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this vulnerability, so ensure you update to the patched version.
August 7, 2026
CVE-2026-15252: Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-15252 affects the Metasync plugin for WordPress (up to version 2.6.12) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
August 7, 2026
CVE-2026-14305: WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-14305 affects the Delicious Recipes plugin for WordPress, allowing unauthorized access due to a missing capability check. Users should update to version 1.10.2 to mitigate this medium-severity vulnerability.
August 7, 2026
CVE-2026-14231: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-14231 affects the LifterLMS plugin for WordPress (up to version 10.0.10) with a medium severity (CVSS 4.3) vulnerability allowing authenticated users to access sensitive data. Users should update to the patched version to...
August 7, 2026
CVE-2026-14207: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 10.0.9 Authenticated (Custom role+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-14207 affects LifterLMS plugin versions up to 10.0.9, with a CVSS score of 6.4. Users should upgrade to version 10.0.10 to mitigate the Stored Cross-Site Scripting vulnerability.
August 6, 2026
CVE-2026-11907: Stream <= 4.2.0 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API PoC, Patch Analysis & Rule
CVE-2026-11907 affects the Stream plugin for WordPress (up to 4.2.0) with a medium severity (CVSS 6.5) authentication bypass. Users should update to version 4.2.1 to mitigate unauthorized access to sensitive activity records.
August 6, 2026
CVE-2026-14364: TrueBooker <= 1.2.3 Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' PoC, Patch Analysis & Rule
CVE-2026-14364 affects the Truebooker Appointment Booking plugin (up to v1.2.3) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this to reset passwords and take over accounts. Update to v1.2.4 to mitigate.
August 6, 2026
CVE-2026-14365: TrueBooker <= 1.2.3 Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' PoC, Patch Analysis & Rule
CVE-2026-14365 reveals a critical authentication bypass in the Truebooker Appointment Booking plugin (v1.2.3 and below) with a CVSS score of 9.8. Upgrade to v1.2.4 to mitigate unauthorized password resets.
August 6, 2026
CVE-2026-61973: ShopLentor Pro <= 2.8.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-61973 affects Woolentor Addons Pro (up to v2.8.5) with a medium severity CVSS score of 4.3. Authenticated users can exploit a missing capability check, so ensure you update to the patched version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.