AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 6, 2026
CVE-2026-28144: WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.6 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-28144 affects the WP Google Map Plugin (up to v4.9.6) with a medium severity score of 4.3. Authenticated users can access sensitive data; update to v4.9.7 to mitigate this vulnerability.
August 6, 2026
CVE-2026-12801: Ultra Addons for Contact Form 7 <= 3.5.43 Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes PoC, Patch Analysis & Rule
CVE-2026-12801 affects the Ultimate Addons For Contact Form 7 plugin (up to version 3.5.43) with a medium severity CVSS of 6.4. Patch to version 3.5.44 to mitigate stored XSS risks from insufficient input sanitization.
August 6, 2026
CVE-2026-61972: ShopLentor Pro <= 2.8.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-61972 affects the Woolentor Addons Pro plugin (up to v2.8.5) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability, so ensure timely patching to mitigate risks.
August 6, 2026
CVE-2026-66702: Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66702 affects the Rank Math SEO plugin (versions up to 1.0.274.1) with a high severity CVSS score of 7.2 due to stored XSS. Users should update to version 1.0.275 to mitigate potential attacks.
August 6, 2026
CVE-2026-66707: Meta for WooCommerce <= 3.7.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66707 affects the Facebook For WooCommerce plugin (up to version 3.7.5) with a CVSS score of 7.2. Unauthenticated XSS vulnerabilities can be mitigated by updating to version 3.7.6.
August 6, 2026
CVE-2026-66664: GEO Plugin by Squirrly SEO <= 14.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66664 affects the Squirrly SEO plugin (versions 14.1.1 and earlier) with a medium severity XSS vulnerability. Users should upgrade to version 14.2.0 to mitigate the risk of unauthorized script injection.
August 6, 2026
CVE-2026-61971: User Profile Picture <= 2.6.3 Authenticated (Author+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-61971 affects the Metronet Profile Picture plugin (up to version 2.6.3) with a medium severity (CVSS 4.3) IDOR vulnerability, allowing unauthorized actions by authenticated users. Upgrade to version 2.6.4 to mitigate risks.
August 6, 2026
CVE-2026-66705: Meta pixel for WordPress <= 5.2.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66705 affects the Official Facebook Pixel plugin (up to 5.2.1) with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts. Update to version 5.2.2 to mitigate risks.
August 6, 2026
CVE-2026-11881: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-11881 affects Fluentform versions up to 6.2.6, exposing users to medium severity stored cross-site scripting due to poor input sanitization. Ensure you update to the patched version to mitigate this risk.
August 6, 2026
CVE-2026-66711: WPML Multilingual & Multicurrency for WooCommerce <= 5.5.6 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66711 affects the Woocommerce Multilingual plugin (up to v5.5.6) with a CVSS score of 6.4, exposing users to stored XSS risks. Update to v5.5.7 to mitigate this vulnerability.
August 6, 2026
CVE-2026-28145: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.39 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-28145 affects the MasterStudy LMS plugin (up to v3.7.39) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Upgrade to v3.7.40 to mitigate this risk.
August 6, 2026
CVE-2026-13345: Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-13345 affects Essential Addons For Elementor Lite (up to v6.6.10) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this missing capability check, so ensure you update to the patched version.
August 6, 2026
CVE-2026-66690: GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-66690 affects the GiveWP Donation Plugin (up to version 4.16.5) with a CVSS score of 7.2. This high-severity XSS vulnerability requires immediate patching to prevent unauthorized script execution.
August 6, 2026
CVE-2026-61970: Auto Featured Image (Auto Post Thumbnail) <= 5.0.4 Authenticated (Contributor+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-61970 affects the Auto Post Thumbnail plugin for WordPress (up to v5.0.4) with a medium severity CVSS score of 6.4. Authenticated users can exploit this SSRF vulnerability, so update to v5.0.5 to mitigate risks.
August 6, 2026
CVE-2026-14310: Tutor LMS – eLearning and online course solution < 4.0.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-14310 affects the Tutor LMS plugin for WordPress (version 4.0.0) with a medium severity (CVSS 4.3). It allows authenticated users to perform unauthorized actions. Update to the patched version to mitigate risks.
August 6, 2026
CVE-2026-56058: Quform WordPress Form Builder <= 2.23.0 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-56058 affects the Quform plugin (up to version 2.23.0) with a CVSS score of 8.8. It allows authenticated users to upload arbitrary files, risking remote code execution. Update to the patched version to mitigate this risk.
August 5, 2026
CVE-2026-18501: UsersWP <= 1.2.69 Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution PoC, Patch Analysis & Rule
CVE-2026-18501 affects UsersWP versions up to 1.2.69, exposing a medium severity Stored XSS vulnerability. Users should upgrade to 1.2.70 to mitigate the risk of script injection by authenticated users.
August 5, 2026
CVE-2025-15028: FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15028 affects the Formgent plugin (up to v1.9.2) with a high severity CVSS of 7.2 due to stored XSS vulnerabilities. Users should upgrade to v1.10.0 to mitigate potential attacks.
August 5, 2026
CVE-2026-0673: Element Pack Addons for Elementor <= 8.3.15 Unauthenticated SMTP Header Injection PoC, Patch Analysis & Rule
CVE-2026-0673 affects Bdthemes Element Pack Lite plugin versions up to 8.3.15, allowing unauthenticated Email Header Injection. Upgrade to 8.3.16 to mitigate this medium severity vulnerability with a CVSS score of 5.3.
August 5, 2026
CVE-2026-18510: TranslatePress <= 3.2.6 Unauthenticated Stored Cross-Site Scripting via Comment Content PoC, Patch Analysis & Rule
CVE-2026-18510 affects the TranslatePress Multilingual plugin (up to v3.2.6) with a high severity CVSS score of 7.2. Unauthenticated attackers can exploit this XSS vulnerability; users should upgrade to v3.3 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.