AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-15482: Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-15482 affects the Chapa Payment Gateway for WooCommerce (up to v1.0.3) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated data exposure. Patching is essential to protect sensitive information.
March 18, 2026
CVE-2026-0572: WebPurify Profanity Filter <= 4.0.2 Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options PoC, Patch Analysis & Rule
CVE-2026-0572 affects the WebPurify Profanity Filter plugin for WordPress (up to version 4.0.2) with a CVSS score of 6.5. Unauthenticated attackers can modify settings, so update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-0743: WP Content Permission <= 1.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter PoC, Patch Analysis & Rule
CVE-2026-0743 affects the WP Content Permission plugin (up to v1.2) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit a stored XSS vulnerability via the 'ohmem-message' parameter. Patch is recommended.
March 18, 2026
CVE-2025-15508: Magic Import Document Extractor <= 1.0.6 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-15508 affects the Magic Import Document Extractor plugin (up to v1.0.6) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive license key information. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-15507: Magic Import Document Extractor <= 1.0.5 Missing Authorization to Unauthenticated Plugin License Status Modification PoC, Patch Analysis & Rule
CVE-2025-15507 affects the Magic Import Document Extractor plugin (up to version 1.0.5) with a CVSS score of 5.3. Unauthenticated attackers can modify license status and credit balance. Update to version 1.0.6 to mitigate this risk.
March 18, 2026
CVE-2025-14461: Xendit Payment <= 6.0.2 Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid PoC, Patch Analysis & Rule
CVE-2025-14461 affects the Woo Xendit Virtual Accounts plugin (up to v6.0.2) with a CVSS score of 5.3. Unauthenticated attackers can manipulate order statuses, leading to potential financial loss. Upgrade to v6.1.0 to mitigate this risk.
March 18, 2026
CVE-2026-1370: SIBS WooCommerce <= 2.2.0 Authenticated (Admin+) SQL Injection via 'referencedId' Parameter PoC, Patch Analysis & Rule
CVE-2026-1370 affects the SIBS WooCommerce plugin (up to v2.2.0) with a medium severity (CVSS 4.9) SQL injection vulnerability. Admins should patch to prevent data exposure.
March 18, 2026
CVE-2026-1755: Menu Icons by ThemeIsle <= 0.13.20 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1755 affects the Menu Icons plugin for WordPress (up to version 0.13.20) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability; update to version 0.13.21 to mitigate risks.
March 18, 2026
CVE-2026-24944: Subscribe2 <= 10.44 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24944 affects the Subscribe2 plugin for WordPress (up to v10.44) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity vulnerability for unauthorized data access. Update to v10.45 to mitigate risks.
March 18, 2026
CVE-2026-0681: Extended Random Number Generator <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PoC, Patch Analysis & Rule
CVE-2026-0681 affects the Extended Random Number Generator plugin for WordPress (up to version 1.1) with a medium severity CVSS score of 4.4. Admin-level attackers can exploit this XSS vulnerability, so patching is essential.
March 18, 2026
CVE-2025-15285: SEO Flow by LupsOnline <= 2.2.1 Unauthenticated Arbitrary Post/Category Modification PoC, Patch Analysis & Rule
CVE-2025-15285 affects the Lupsonline Link Netwerk plugin (up to version 2.2.1) with a high severity CVSS score of 7.5. Unauthenticated attackers can modify blog content; users should upgrade to version 3.0.0 to mitigate this risk.
March 18, 2026
CVE-2026-1756: WP FOFT Loader <= 2.1.39 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-1756 affects the WP FOFT Loader plugin (up to version 2.1.39) with a high severity CVSS score of 8.8. Authenticated users can exploit this file upload vulnerability, making timely patching essential.
March 18, 2026
CVE-2026-24946: Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24946 affects the Woocommerce Delivery Notes plugin (up to v5.8.0) with a medium severity CVSS score of 5.3, allowing unauthorized access. Update to v5.9.0 to mitigate this remote code execution risk.
March 18, 2026
CVE-2026-24948: Reflector <= 1.2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24948 affects the Reflector plugin for WordPress (up to 1.2.2) with a medium severity (CVSS 6.1) XSS vulnerability. Users should update to the patched version to mitigate the risk of script injection.
March 18, 2026
CVE-2026-24950: Authorsy <= 1.0.6 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-24950 affects the Authorsy plugin (up to 1.0.6) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive author data. Update to version 1.0.7 to mitigate this vulnerability.
March 18, 2026
CVE-2026-24941: WP Job Portal <= 2.4.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24941 affects the WP Job Portal plugin (up to version 2.4.4) with a CVSS score of 5.3. It allows unauthorized access to sensitive resume data. Update to version 2.4.5 to mitigate this vulnerability.
March 18, 2026
CVE-2025-67624: Optimize More! – Images <= 1.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67624 affects the Optimize More Images plugin for WordPress (up to version 1.1.3) with a medium severity (CVSS 5.3) vulnerability. Unauthenticated attackers can exploit this flaw, so patching is essential.
March 18, 2026
CVE-2026-1730: OS DataHub Maps <= 1.8.3 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-1730 affects the OS DataHub Maps plugin for WordPress (up to v1.8.3) with a high severity CVSS score of 8.8. Patch to v1.8.4 to mitigate the risk of arbitrary file uploads and potential remote code execution.
March 18, 2026
CVE-2026-0617: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-0617 affects the LatePoint plugin (up to version 5.2.5) with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts via customer profiles. Upgrade to version 5.2.6 to mitigate risks.
March 18, 2026
CVE-2026-1371: Tutor LMS <= 3.9.5 Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-1371 affects Tutor plugin versions up to 3.9.5 with a medium severity (CVSS 5.3). Authenticated users can access sensitive coupon information. Update to version 3.9.6 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.