AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24585: Hyyan WooCommerce Polylang Integration <= 1.5.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24585 affects the Woo Poly Integration plugin (up to v1.5.0) with a CVSS score of 4.3. This medium-severity vulnerability allows authenticated users to execute unauthorized actions. Patching is recommended.
March 18, 2026
CVE-2026-24588: Smart Product Viewer <= 1.5.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24588 affects the Smart Product Viewer plugin (up to v1.5.4) with a medium severity (CVSS 4.3) flaw allowing unauthorized actions by authenticated users. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24984: Visual Link Preview <= 2.2.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24984 affects the Visual Link Preview plugin (up to v2.2.9) with a CVSS score of 4.3. Authenticated attackers can exploit a missing capability check. Upgrade to v2.3.0 to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-24982: Spectra <= 2.19.17 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24982 affects the Ultimate Addons For Gutenberg plugin (up to version 2.19.17) with a CVSS score of 5.3. Unauthenticated users can exploit this vulnerability, so update to version 2.19.18 to mitigate unauthorized access.
March 18, 2026
CVE-2026-24587: AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24587 affects the Ajax Hits Counter plugin (versions
March 18, 2026
CVE-2026-24355: Houzez Theme Functionality <= 4.2.6 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24355 affects the Houzez Theme - Functionality plugin (up to version 4.2.6) with a CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure timely patching to mitigate risks.
March 18, 2026
CVE-2025-69300: Premium Addons for Elementor <= 4.11.63 Missing Authorization to Authenticated (Subscriber+) Settings Update PoC, Patch Analysis & Rule
CVE-2025-69300 affects the Premium Addons for Elementor plugin (up to v4.11.63) with a CVSS score of 4.3. Authenticated attackers can modify settings; update to v4.11.64 to mitigate this risk.
March 18, 2026
CVE-2026-24549: GeoDirectory <= 2.8.149 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24549 affects the GeoDirectory plugin for WordPress (up to version 2.8.149) with a medium severity CVSS score of 4.3. Patch to version 2.8.150 to mitigate the Cross-Site Request Forgery risk from unauthenticated attackers.
March 18, 2026
CVE-2026-24551: Monetag Official <= 1.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24551 affects the Monetag Official plugin (up to v1.1.3) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v2.2.5 to mitigate this risk.
March 18, 2026
CVE-2026-24550: Blockons <= 1.2.15 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24550 affects the Blockons plugin for WordPress (up to version 1.2.15) with a medium severity CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, making timely patching essential.
March 18, 2026
CVE-2024-11976: BuddyPress <= 14.3.3 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2024-11976 affects BuddyPress plugin versions up to 14.3.3, allowing unauthenticated remote code execution with a CVSS score of 7.3. Update to version 14.3.4 to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2025-67969: UPI QR Code Payment Gateway for WooCommerce <= 1.5.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67969 affects the UPI QR Code Payment for WooCommerce plugin (up to v1.5.1) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this to manipulate payment confirmations. Update to v1.6.1 to mitigate.
March 18, 2026
CVE-2026-24992: Advanced WooCommerce Product Sales Reporting <= 4.1.2 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24992 affects the Webd Woocommerce Advanced Reporting Statistics plugin (up to v4.1.2) with a medium severity (CVSS 5.3) vulnerability allowing remote code execution. Update to v4.1.3 to mitigate sensitive data exposure.
March 18, 2026
CVE-2025-69295: Coven Core <= 1.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69295 reveals a high-severity SQL injection vulnerability in the Coven Core plugin for WordPress, affecting versions up to 1.3. Users should update to the patched version to protect against potential data breaches.
March 18, 2026
CVE-2025-14069: Schema & Structured Data for WP & AMP <= 1.54 Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema PoC, Patch Analysis & Rule
CVE-2025-14069 affects the Schema And Structured Data For WP plugin (up to v1.54) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so update to v1.54.1 to mitigate risks.
March 18, 2026
CVE-2026-24559: Integration for Contact Form 7 HubSpot <= 1.4.3 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24559 affects the Cf7 Hubspot plugin (up to v1.4.3) with a CVSS score of 4.3. Authenticated attackers can access sensitive data. Upgrade to v1.4.4 to mitigate this risk.
March 18, 2026
CVE-2026-24560: Cloudinary <= 3.3.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24560 affects the Cloudinary Image Management plugin for WordPress (up to version 3.3.0) with a medium severity (CVSS 4.3). Patching to version 3.3.1 is essential to prevent unauthorized access by authenticated users.
March 18, 2026
CVE-2026-24553: Fraud Prevention For Woocommerce <= 2.3.2 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24553 affects Woo Blocker Lite (up to v2.3.2) with a CVSS score of 4.3. Authenticated attackers can exploit this medium-severity vulnerability to access sensitive data. Upgrade to v2.3.3 to mitigate risks.
March 18, 2026
CVE-2026-0927: KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 Missing Authorization to Unauthenticated Limited Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-0927 affects the Kivicare Clinic Management System plugin (up to v3.6.15) with a medium severity (CVSS 5.3) file upload vulnerability. Ensure you update to the patched version to mitigate potential unauthorized file uploads.
March 18, 2026
CVE-2025-15522: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-15522 affects the Uncanny Automator plugin (up to version 6.10.0.2) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so update to version 7.0.0 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.