AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1375: Tutor LMS <= 3.9.5 Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion PoC, Patch Analysis & Rule
CVE-2026-1375 affects the Tutor LMS plugin (up to version 3.9.5) with a CVSS score of 8.1. Authenticated users can manipulate course data due to missing authorization checks. Update to version 3.9.6 to mitigate this risk.
March 18, 2026
CVE-2026-1058: Form Maker by 10Web <= 1.15.35 Unauthenticated Stored Cross-Site Scripting via Hidden Field PoC, Patch Analysis & Rule
CVE-2026-1058 affects the Form Maker plugin (up to v1.15.35) with a CVSS score of 7.1, allowing stored XSS attacks. Update to v1.15.36 to mitigate risks from unauthenticated script injections in admin views.
March 18, 2026
CVE-2026-1065: Form Maker by 10Web <= 1.15.35 Unauthenticated Stored Cross-Site Scripting via SVG file PoC, Patch Analysis & Rule
CVE-2026-1065 affects the Form Maker plugin (up to v1.15.35) with a high severity CVSS score of 7.2 due to stored XSS. Update to v1.15.36 to mitigate risks from malicious SVG file uploads.
March 18, 2026
CVE-2026-1210: Happy Addons for Elementor <= 3.20.7 Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field PoC, Patch Analysis & Rule
CVE-2026-1210 affects the Happy Elementor Addons plugin (up to version 3.20.7) with a medium severity CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so update to version 3.20.8 to mitigate risks.
March 18, 2026
CVE-2026-1447: Mail Mint <= 1.19.2 Cross-Site Request Forgery to Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1447 affects the Mail Mint plugin (up to version 1.19.2) with a medium severity score of 5.4. Unauthenticated attackers can exploit this cross-site scripting vulnerability, so update to version 1.19.3 to mitigate risks.
March 18, 2026
CVE-2026-25024: ThirstyAffiliates <= 3.11.9 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-25024 affects the ThirstyAffiliates plugin (up to v3.11.9) with a medium severity (CVSS 4.3) CSRF vulnerability. Update to v3.11.10 to mitigate unauthorized actions by attackers.
March 18, 2026
CVE-2025-14274: Unlimited Elements for Elementor <= 2.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget PoC, Patch Analysis & Rule
CVE-2025-14274 affects the Unlimited Elements For Elementor plugin (up to v2.0.1) with a CVSS score of 5.4. Authenticated attackers can exploit this XSS vulnerability, so ensure timely patching to mitigate risks.
March 18, 2026
CVE-2026-0909: WP ULike <= 4.8.3.1 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter PoC, Patch Analysis & Rule
CVE-2026-0909 affects the WP ULike plugin (up to version 4.8.3.1) with a medium severity (CVSS 5.3) vulnerability. Authenticated users can delete other users' log entries. Update to version 5.0.0 to mitigate this risk.
March 18, 2026
CVE-2026-25326: CMSMasters Content Composer <= 1.4.5 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-25326 affects the Cmsmasters Content Composer plugin for WordPress (up to v1.4.5) with a high severity CVSS score of 7.5. Authenticated attackers can exploit this authentication bypass to execute arbitrary files. Update to the...
March 18, 2026
CVE-2026-25023: Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-25023 affects the Contest Code Checker plugin (up to version 2.0.7), allowing unauthenticated attackers to access sensitive data. Apply the latest patch to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-0950: Spectra Gutenberg Blocks <= 2.19.17 Unauthenticated Information Disclosure in Sensitive Data PoC, Patch Analysis & Rule
CVE-2026-0950 affects the Ultimate Addons For Gutenberg plugin (up to v2.19.17) with a medium severity (CVSS 5.3) information disclosure vulnerability. Update to v2.19.18 to prevent unauthorized access to password-protected post excerpts.
March 18, 2026
CVE-2026-1369: Conditional CAPTCHA <= 4.0.0 Unauthenticated Open Redirect PoC, Patch Analysis & Rule
CVE-2026-1369 affects the Conditional CAPTCHA plugin for WordPress (up to version 4.0.0) with a CVSS score of 5.3. Unauthenticated attackers can exploit this open redirect vulnerability, so patching is essential.
March 18, 2026
CVE-2026-23978: Gyan Elements <= 2.2.1 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-23978 affects the Gyan Elements plugin for WordPress (up to version 2.2.1) with a CVSS score of 7.5. Authenticated users can exploit this authentication bypass to execute arbitrary files. Immediate patching is advised.
March 18, 2026
CVE-2025-15525: Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure PoC, Patch Analysis & Rule
CVE-2025-15525 affects the Ajax Load More plugin (up to version 7.8.1) with a CVSS score of 5.3. This medium-severity flaw allows unauthorized access to post titles and excerpts. Update to version 7.8.2 to mitigate risks.
March 18, 2026
CVE-2025-15510: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 Missing Authorization to Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-15510 affects the Nex Forms Express WP Form Builder plugin (up to version 9.1.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized data export. Update to version 9.1.9 to mitigate risks.
March 18, 2026
CVE-2026-1165: Popup Box <= 6.1.1 Cross-Site Request Forgery to Popup Status Change PoC, Patch Analysis & Rule
CVE-2026-1165 affects the Ays Popup Box plugin (up to v6.1.1) with a medium severity (CVSS 4.3) Cross-Site Request Forgery vulnerability. Update to v6.1.2 to mitigate the risk of unauthorized popup status changes.
March 18, 2026
CVE-2026-25022: KiviCare <= 3.6.16 Authenticated (Receptionist+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-25022 affects Kivicare Clinic Management System versions up to 3.6.16, exposing a medium severity SQL injection vulnerability (CVSS 6.5). Users should upgrade to version 4.0.0 to mitigate potential data exposure risks.
March 18, 2026
CVE-2026-25019: Atarim <= 4.3.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25019 affects Atarim Visual Collaboration plugin versions up to 4.3.1, allowing unauthorized access due to a missing capability check. Upgrade to version 4.3.2 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-1431: Booking Calendar <= 10.14.13 Missing Authorization to Unauthenticated Booking Details Exposure PoC, Patch Analysis & Rule
CVE-2026-1431 affects the Booking Calendar plugin (up to version 10.14.13) with a medium severity CVSS score of 5.3. Unauthenticated attackers can access sensitive booking data; update to version 10.14.14 to mitigate.
March 18, 2026
CVE-2026-0683: SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 Authenticated (Subscriber+) SQL Injection via Number Field Filter PoC, Patch Analysis & Rule
CVE-2026-0683 affects the SupportCandy plugin (up to 3.4.4) with a medium severity SQL injection vulnerability (CVSS 6.5). Users should upgrade to version 3.4.5 to mitigate potential data exposure risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.