AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 5, 2026
CVE-2026-5108: Super Progressive Web Apps <= 2.2.43 Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting PoC, Patch Analysis & Rule
CVE-2026-5108 affects the Super Progressive Web Apps plugin for WordPress (up to 2.2.43) with a medium severity (CVSS 4.4) Stored XSS vulnerability. Update to version 2.2.44 to mitigate risks of script injection.
August 5, 2026
CVE-2026-7441: Simple Yearly Archive <= 2.2.4 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-7441 affects the Simple Yearly Archive plugin (up to v2.2.4) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Update to v2.2.5 to mitigate risks from authenticated attackers injecting scripts.
August 5, 2026
CVE-2026-6639: AI Chatbot & Workflow Automation by AIWU <= 1.4.6 Missing Authorization to Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2026-6639 affects the Ai Copilot Content Generator plugin (up to 1.4.6) with a CVSS score of 7.5. Unauthenticated attackers can access sensitive data, including API keys. Users should update to the patched version to mitigate this risk.
August 5, 2026
CVE-2026-5062: PrettyLinks <= 3.6.20 Authenticated (Administrator+) SQL Injection via 's' Parameter PoC, Patch Analysis & Rule
CVE-2026-5062 affects the Pretty Link plugin for WordPress (up to version 3.6.20) with a CVSS score of 4.9. Admins should update to 3.6.21 to mitigate SQL injection risks that could expose sensitive database information.
August 5, 2026
CVE-2026-7529: wiseCampaign <= 1.1.16 Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API PoC, Patch Analysis & Rule
CVE-2026-7529 affects the Wisecampaign plugin for WordPress (up to version 1.1.16) with a CVSS score of 7.5. Unauthenticated attackers can exploit this high-severity remote code execution flaw, so update to version 1.1.17 immediately.
August 5, 2026
CVE-2026-15941: Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-15941 affects Relevanssi Premium version 2.30.2 with a medium severity CVSS score of 6.5. Authenticated users can exploit a SQL injection vulnerability. Ensure to update to the patched version to mitigate risks.
August 5, 2026
CVE-2026-7753: Cost Calculator Builder <= 3.6.17 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure PoC, Patch Analysis & Rule
CVE-2026-7753 affects the Cost Calculator Builder plugin (up to v3.6.17) with a medium severity (CVSS 6.5) vulnerability allowing unauthorized data export. Update to v4.0.3 to mitigate risks associated with sensitive configuration exposure.
August 5, 2026
CVE-2026-15979: Content Egg <= 11.3.0 Authenticated (Author+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-15979 affects the Content Egg plugin for WordPress (up to 11.3.0) with a CVSS score of 8.1. Authenticated users can exploit this file upload vulnerability to delete arbitrary files. Upgrade to version 11.4.0 to mitigate.
August 5, 2026
CVE-2026-8790: Football Pool <= 2.13.4 Authenticated (Subscriber+) Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-8790 affects the Football Pool plugin for WordPress (up to 2.13.4) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to version 2.13.5 to mitigate potential attacks.
August 5, 2026
CVE-2026-15941: Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-15941 affects Relevanssi versions 4.27.1 and earlier, allowing SQL injection via the Admin Search AJAX handler. Update to version 4.27.2 to mitigate this medium-severity vulnerability with a CVSS score of 6.5.
August 5, 2026
CVE-2026-9273: Membership Plugin – Kadence Memberships <= 4.0.0 Unauthenticated Password Reset Link Poisoning to Account Takeover PoC, Patch Analysis & Rule
CVE-2026-9273 affects the Kadence Memberships plugin (up to version 4.0.0) with a critical CVSS score of 9.3, allowing unauthenticated attackers to poison password reset links. Upgrade to version 4.0.1 to mitigate this risk.
August 5, 2026
CVE-2026-11421: ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter PoC, Patch Analysis & Rule
CVE-2026-11421 affects the ERP: Complete HR, Accounting & CRM Suite plugin for WordPress, allowing SQL injection in versions up to 1.17.4. Users should upgrade to 1.17.5 to mitigate this medium severity vulnerability.
August 5, 2026
CVE-2026-8761: Dokan <= 5.0.2 Missing Authorization to Authenticated (Vendor+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-8761 affects the Dokan Lite plugin for WordPress (versions
August 5, 2026
CVE-2026-16143: VikRentItems Flexible Rental Management System <= 1.2.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-16143 affects the VikRentItems plugin (up to v1.2.1) with a high severity CVSS score of 7.2 due to stored XSS. Upgrade to v1.2.2 to mitigate risks from unauthenticated script injection.
August 5, 2026
CVE-2026-17506: Independent Analytics <= 2.15.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-17506 affects the Independent Analytics plugin for WordPress (up to 2.15.0) with a CVSS score of 7.2. Unauthenticated stored XSS can be exploited; update to 2.15.1 to mitigate risks.
July 26, 2026
CVE-2025-66076: Woostify Sites Library <= 1.6.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66076 affects the Woostify Sites Library plugin for WordPress (up to v1.6.2) with a medium severity (CVSS 5.3) vulnerability due to missing authorization checks. Update to the latest version to mitigate unauthorized access risks.
July 26, 2026
CVE-2026-57625: Admin and Site Enhancements (ASE) Pro <= 8.8.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-57625 affects the Admin Site Enhancements Pro plugin for WordPress (up to v8.8.5) with a CVSS score of 7.2. Unauthenticated attackers can exploit this XSS vulnerability; patching is essential to mitigate risks.
July 26, 2026
CVE-2025-69134: OpenAI Chatbot for WordPress – Helper <= 1.1.4 Missing Authorization to Unauthenticated Arbitrary Content Deletion PoC, Patch Analysis & Rule
CVE-2025-69134 affects the Helper plugin for WordPress (up to 1.1.4) with a medium severity CVSS score of 5.3. Unauthenticated attackers can delete content due to a missing capability check. Patching is essential.
July 26, 2026
CVE-2026-57688: POS Entegratör – Gurmehub Ödeme Eklentisi <= 3.7.103 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-57688 affects the POS Entegratör plugin for WordPress (up to version 3.7.103) with a medium severity score of 5.3. Users should upgrade to version 3.8.0 to mitigate unauthorized access risks.
July 26, 2026
CVE-2026-57331: Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 Authenticated (Performer+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-57331 affects the Ppv Live Webcams plugin (up to version 7.4.8) with a high severity CVSS score of 8.1. Authenticated attackers can delete arbitrary files, risking remote code execution. Patch immediately.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.