AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24951: myCred <= 2.9.7.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24951 affects the myCred plugin (up to version 2.9.7.3) with a CVSS score of 4.3. It allows authenticated users to bypass controls for badge management. Update to version 2.9.7.4 to mitigate this vulnerability.
March 18, 2026
CVE-2025-12803: Bold Builder <= 5.5.1 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode PoC, Patch Analysis & Rule
CVE-2025-12803 affects the Bold Page Builder plugin (up to v5.5.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit a stored XSS vulnerability, making patching essential for security.
March 18, 2026
CVE-2025-15267: Bold Page Builder <= 5.5.7 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode PoC, Patch Analysis & Rule
CVE-2025-15267 affects the Bold Page Builder plugin (up to v5.5.7) with a medium severity CVSS score of 6.4 due to stored XSS vulnerabilities. Ensure you update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-1499: WP Duplicate <= 1.1.8 Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-1499 affects the Local Sync plugin (up to 1.1.8) with a CVSS score of 9.8. This critical file upload vulnerability allows authenticated attackers to execute arbitrary code. Upgrade to version 1.1.9 to mitigate risks.
March 18, 2026
CVE-2026-1252: Events Listing Widget <= 1.3.4 Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field PoC, Patch Analysis & Rule
CVE-2026-1252 affects the Events Listing Widget plugin (up to v1.3.4) with a medium severity (CVSS 6.4) XSS vulnerability. Update to v1.3.5 to mitigate risks from authenticated attackers exploiting the 'Event URL' parameter.
March 18, 2026
CVE-2026-1785: Code Snippets <= 3.9.4 Cross-Site Request Forgery to Cloud Snippet Download/Update Actions PoC, Patch Analysis & Rule
CVE-2026-1785 affects the Code Snippets plugin for WordPress (up to version 3.9.4) with a medium severity CVSS score of 4.3 due to a Cross-Site Request Forgery vulnerability. Update to version 3.9.5 to mitigate risks.
March 18, 2026
CVE-2026-1293: Yoast SEO <= 26.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute PoC, Patch Analysis & Rule
CVE-2026-1293 affects the Yoast SEO plugin for WordPress versions up to 26.8, with a medium severity (CVSS 6.4) due to stored cross-site scripting. Upgrade to version 26.9 to mitigate this vulnerability.
March 18, 2026
CVE-2025-10753: OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-10753 affects the Miniorange Login With Eve Online Google Facebook plugin (up to version 6.26.14) with a CVSS score of 5.3. Unauthenticated attackers can modify redirect URLs, so update to 6.26.15 to mitigate this risk.
March 18, 2026
CVE-2026-1888: Docus <= 1.0.6 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1888 affects the Docus plugin for WordPress, versions up to 1.0.6, with a medium severity CVSS score of 6.4. Users should upgrade to version 1.0.7 to mitigate the stored cross-site scripting vulnerability.
March 18, 2026
CVE-2026-1808: Orange Confort+ accessibility toolbar for WordPress <= 0.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1808 affects the Orange Confort Plus plugin (up to v0.7) with a CVSS score of 6.4. Authenticated users can exploit a stored XSS vulnerability. Update to v0.7.1 to mitigate risks.
March 18, 2026
CVE-2026-1279: Employee Directory <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1279 affects the Employee Staff Directory plugin (up to v1.2.1) with a medium severity (CVSS 6.4) cross-site scripting vulnerability. Update to v1.2.2 to mitigate the risk of authenticated attacks.
March 18, 2026
CVE-2026-1909: WaveSurfer-WP <= 2.8.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1909 affects the WaveSurfer WP plugin (up to v2.8.3) with a medium severity CVSS score of 6.4 due to stored XSS. Users should update to v2.8.4 to mitigate the risk of script injection by authenticated attackers.
March 18, 2026
CVE-2025-69374: Eleblog – Elementor Blog And Magazine Addons <= 2.0.3 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-69374 affects the Ele Blog plugin for WordPress (up to 2.0.3) with a high severity CVSS score of 8.1. This authentication bypass vulnerability allows unauthenticated attackers to execute arbitrary PHP code. Patching is essential.
March 18, 2026
CVE-2026-1228: Timeline Block <= 1.3.3 Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1228 affects the Timeline Block plugin (up to v1.3.3) with a CVSS score of 4.3. Authenticated users can access private timeline content. Update to v1.3.4 to mitigate this vulnerability.
March 18, 2026
CVE-2025-68028: GA4WP: Google Analytics for WordPress <= 2.10.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68028 affects the GA4WP plugin (up to v2.10.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69378: Product Filter for WooCommerce <= 9.1.2 Authenticated (Shop Manager+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-69378 affects the Prdctfltr plugin for WordPress, allowing authenticated attackers to escalate privileges to Administrator level. Users should update from version 9.1.2 to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2025-69377: User Extra Fields <= 17.0 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-69377 affects the Wp User Extra Fields plugin (up to v17.0) with a high CVSS of 8.1. Authenticated attackers can delete arbitrary files, risking remote code execution. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-69376: User Extra Fields <= 17.0 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-69376 affects the Wp User Extra Fields plugin (up to version 17.0) with a critical CVSS score of 9.8. Unauthenticated attackers can delete arbitrary files, risking remote code execution. Update to the patched version immediately.
March 18, 2026
CVE-2025-68026: LC Wizard <= 2.1.1 Missing Authorization to Unauthenticated Settings Update PoC, Patch Analysis & Rule
CVE-2025-68026 affects the Ghl Wizard plugin (up to v2.1.1) with a CVSS score of 5.3. Unauthenticated attackers can modify settings, highlighting the need for immediate patching to v2.1.2 to mitigate risks.
March 18, 2026
CVE-2026-1927: GreenShift Animation and Page Builder Blocks <= 12.6 Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css PoC, Patch Analysis & Rule
CVE-2026-1927 affects the Greenshift Animation And Page Builder Blocks plugin (up to v12.6) with a CVSS score of 5.4. Authenticated attackers can exploit a missing capability check to access sensitive settings. Upgrade to v12.6.1 to...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.