AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 5, 2026
CVE-2026-11983: Ad Inserter <= 2.8.16 Missing Authorization to Block Visibility Bypass via ai_ajax PoC, Patch Analysis & Rule
CVE-2026-11983 affects the Ad Inserter plugin for WordPress (up to 2.8.16) with a medium severity (CVSS 5.3) authentication bypass. Update to version 2.8.17 to mitigate unauthorized access to restricted ad blocks.
August 5, 2026
CVE-2026-5158: PostX <= 5.0.13 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block PoC, Patch Analysis & Rule
CVE-2026-5158 affects the Ultimate Post plugin (up to v5.0.13) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Users should upgrade to v5.0.14 to mitigate risks from authenticated attackers injecting scripts.
August 5, 2026
CVE-2026-18400: Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting PoC, Patch Analysis & Rule
CVE-2026-18400 affects the Ml Slider plugin for WordPress (up to v3.111.0) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit a stored XSS vulnerability; patch to v3.111.1 to mitigate.
August 5, 2026
CVE-2026-5391: LatePoint <= 5.3.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-5391 affects the LatePoint plugin for WordPress (up to version 5.3.2) with a medium severity CVSS of 6.4. Users should upgrade to version 5.4.0 to mitigate the Stored XSS vulnerability.
August 5, 2026
CVE-2026-16636: FluentSMTP <= 2.2.95 Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs PoC, Patch Analysis & Rule
CVE-2026-16636 affects Fluent SMTP plugin versions up to 2.2.95, exposing a high severity cross-site scripting risk (CVSS 7.2). Upgrade to 2.3.0 to mitigate potential script injection in email logs.
August 5, 2026
CVE-2026-13395: Online Scheduling and Appointment Booking System – Bookly < 27.8 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-13395 affects the Bookly Responsive Appointment Booking Tool (v27.8 and earlier) with a high severity CVSS score of 7.5. Unauthenticated attackers can exploit this SQL injection vulnerability to access sensitive database...
August 5, 2026
CVE-2026-15459: WPMU DEV Dashboard <= 5.0.0 Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint PoC, Patch Analysis & Rule
CVE-2026-15459 affects WPMU DEV Dashboard plugin version 5.0.0 and earlier, with a CVSS score of 8.1. Unauthenticated attackers can bypass authentication, allowing them to execute privileged actions. Update to the patched version.
August 5, 2026
CVE-2026-15918: VikAppointments – Services Booking Calendar <= 1.2.19 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-15918 affects VikAppointments plugin version 1.2.19 with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated users to access sensitive data. Upgrade to version 1.2.20 to mitigate risks.
August 5, 2026
CVE-2026-18325: Forminator Forms <= 1.56.1 Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field PoC, Patch Analysis & Rule
CVE-2026-18325 affects the Forminator plugin (up to v1.56.1) with a CVSS score of 7.2. This high-severity XSS vulnerability allows unauthenticated attackers to inject scripts. Update to v1.56.2 to mitigate risks.
August 5, 2026
CVE-2026-61976: JetBlocks for Elementor <= 1.5.0 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-61976 affects the Jet Blocks plugin for WordPress (up to version 1.5.0) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data; ensure you update to the patched version to mitigate this risk.
August 5, 2026
CVE-2026-14602: Remote API <= 0.2 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-14602 reveals a high-severity PHP Object Injection vulnerability in the Remote API plugin for WordPress (versions up to 0.2). Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version.
August 5, 2026
CVE-2026-15235: MotoPress Hotel Booking < 6.0.4 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-15235 affects the MotoPress Hotel Booking Lite plugin (up to version 6.0.4), exposing sensitive user data to authenticated attackers. Ensure you update to the patched version to mitigate this medium severity vulnerability.
August 5, 2026
CVE-2026-18322: Smart Popup by Supsystic <= 1.12.0 Unauthenticated Privilege Escalation to Administrator PoC, Patch Analysis & Rule
CVE-2026-18322 affects the Popup By Supsystic plugin (up to v1.12.0) with a CVSS score of 8.8. Unauthenticated attackers can escalate privileges to create admin accounts. Update to v1.13.0 to mitigate this risk.
August 5, 2026
CVE-2026-61977: JetSearch <= 3.6.1.2 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-61977 affects the Jet Search plugin for WordPress (up to v3.6.1.2), exposing sensitive information to unauthenticated attackers. Update to the patched version to mitigate this medium severity vulnerability.
August 5, 2026
CVE-2026-61975: JetReviews <= 3.0.1 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-61975 affects the Jet Reviews plugin for WordPress (up to version 3.0.1) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data, so patching is essential for security.
August 5, 2026
CVE-2026-7726: Layouts for WPBakery <= 1.1.3 Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-7726 affects the Layouts For WPBakery plugin (up to v1.1.3) with a CVSS score of 6.5. This medium severity vulnerability allows unauthenticated remote code execution. Update to the patched version to mitigate risks.
August 5, 2026
CVE-2026-5116: Contact Form 7 – Dynamic Text Extension <= 5.0.5 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-5116 affects the Contact Form 7 Dynamic Text Extension plugin (up to version 5.0.5) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit this XSS vulnerability, so update to version 5.0.6.
August 5, 2026
CVE-2026-7444: Search Analytics for WP <= 1.4.16 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-7444 affects the Search Analytics for WP plugin (up to version 1.4.16) with a high severity CVSS score of 8.1 due to CSRF vulnerabilities. Upgrade to version 1.5.0 to mitigate the risk of unauthorized data deletion.
August 5, 2026
CVE-2026-7693: Backup Migration <= 2.1.5.1 Authenticated (Administrator+) OS Command Injection via 'file' Parameter PoC, Patch Analysis & Rule
CVE-2026-7693 affects the Backup Backup plugin (up to v2.1.5.1) with a high severity CVSS score of 7.2. Authenticated users can exploit this OS Command Injection vulnerability. Upgrade to v2.1.5.2 to mitigate risks.
August 5, 2026
CVE-2026-5651: Askeet <= 3.0 Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter PoC, Patch Analysis & Rule
CVE-2026-5651 affects the Askeet plugin for WordPress (up to v3.0) with a medium severity (CVSS 4.9) SQL Injection vulnerability. Update to v3.1 to mitigate risks of data exposure by authenticated attackers.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.