AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-2289: Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.3 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-2289 affects the Taskbuilder plugin for WordPress (up to version 5.0.3) with a medium severity (CVSS 4.4) stored XSS vulnerability. Update to version 5.0.4 to mitigate risks associated with this flaw.
March 18, 2026
CVE-2026-2292: Morkva UA Shipping <= 1.7.9 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field PoC, Patch Analysis & Rule
CVE-2026-2292 affects the Morkva UA Shipping plugin (up to v1.7.9) with a medium severity (CVSS 4.4) stored XSS vulnerability. Update to v1.7.10 to mitigate risks associated with insufficient input sanitization.
March 18, 2026
CVE-2026-22460: FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.4.2 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-22460 affects the Formgent plugin (v1.4.2 and below) with a critical CVSS score of 9.1. Unauthenticated attackers can delete arbitrary files, risking remote code execution. Update to version 1.5.0 to mitigate this vulnerability.
March 18, 2026
CVE-2026-28039: wpDataTables (Premium) <= 6.5.0.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-28039 affects wpDataTables plugin version 6.5.0.1, allowing unauthenticated Local File Inclusion with a CVSS score of 8.1. Upgrade to version 6.5.0.2 to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2026-1273: PostX <= 5.0.8 Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints PoC, Patch Analysis & Rule
CVE-2026-1273 affects the Ultimate Post plugin (v5.0.8) with a high severity score of 7.2. Authenticated attackers can exploit SSRF vulnerabilities. Upgrade to v5.0.9 to mitigate risks.
March 18, 2026
CVE-2026-1651: Email Subscribers & Newsletters <= 5.9.16 Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter PoC, Patch Analysis & Rule
CVE-2026-1651 affects the Email Subscribers plugin (up to v5.9.16) with a medium severity (CVSS 6.5) SQL injection vulnerability. Upgrade to v5.9.17 to mitigate risks of data exposure for admin users.
March 18, 2026
CVE-2026-2568: WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-2568 affects the Cf7 Zendesk plugin for WordPress (up to version 1.1.5) with a high severity CVSS of 7.2. Update to version 1.1.6 to mitigate stored XSS risks from form submissions.
March 18, 2026
CVE-2026-24385: Podlove Web Player <= 5.9.1 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-24385 affects the Podlove Web Player plugin (up to version 5.9.1) with a high severity CVSS score of 7.5. Users should upgrade to version 5.9.2 to mitigate the risk of PHP Object Injection vulnerabilities.
March 18, 2026
CVE-2026-22459: WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales <= 1.7.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22459 affects the Easy Sticky Sidebar plugin (up to v1.7.4) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Upgrade to v2.0.0 to mitigate risks.
March 18, 2026
CVE-2026-1492: User Registration & Membership <= 5.1.2 Unauthenticated Privilege Escalation via Membership Registration PoC, Patch Analysis & Rule
CVE-2026-1492 affects the User Registration plugin for WordPress (up to version 5.1.2) with a critical CVSS score of 9.8. Update to version 5.1.3 to mitigate unauthenticated privilege escalation risks.
March 18, 2026
CVE-2026-1487: LatePoint <= 5.2.7 Authenticated (Administrator+) SQL Injection via JSON Import PoC, Patch Analysis & Rule
CVE-2026-1487 affects the LatePoint plugin (up to v5.2.7) with a medium severity (CVSS 6.5) SQL injection vulnerability. Update to v5.2.8 to mitigate risks from authenticated attackers exploiting JSON import.
March 18, 2026
CVE-2026-1336: AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 Missing Authorization to Unauthenticated API Key Modification PoC, Patch Analysis & Rule
CVE-2026-1336 affects Ays Chatgpt Assistant plugin versions up to 2.7.5, allowing unauthorized access to sensitive data. Upgrade to version 2.7.6 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-3180: Contest Gallery <= 28.1.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-3180 affects the Contest Gallery plugin (up to version 28.1.4) with a high severity CVSS score of 7.5 due to SQL injection vulnerabilities. Update to version 28.1.5 to mitigate risks from unauthenticated attacks.
March 18, 2026
CVE-2026-2448: Page Builder by SiteOrigin <= 2.33.5 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-2448 affects the SiteOrigin Panels plugin (up to v2.33.5) with a high severity (CVSS 8.8) local file inclusion vulnerability. Upgrade to v2.34.0 to mitigate risks of unauthorized file execution.
March 18, 2026
CVE-2026-28073: Wp EMember <= 10.2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28073 affects the Wp EMember plugin (up to version 10.2.2) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure to update to the patched version to mitigate risks from potential attacks.
March 18, 2026
CVE-2026-2628: All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-2628 affects the Login With Azure plugin (up to version 2.2.5) with a critical CVSS score of 9.8. Unauthenticated attackers can bypass authentication, allowing unauthorized access. Update to the patched version immediately.
March 18, 2026
CVE-2026-1566: LatePoint <= 5.2.7 Authenticated (Agent+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-1566 affects the LatePoint plugin (up to 5.2.7) with a CVSS score of 8.8, allowing privilege escalation via password reset. Upgrade to version 5.2.8 to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2026-3132: Master Addons for Elementor Premium <= 2.1.3 Authenticated (Subscriber+) Remote Code Execution via render_preview PoC, Patch Analysis & Rule
CVE-2026-3132 affects Master Addons Pro (up to v2.1.3) with a CVSS score of 8.8. This high-severity remote code execution vulnerability allows authenticated users to execute code on the server. Update to the patched version to mitigate...
March 18, 2026
CVE-2026-28038: Ultimate Addons for WPBakery Page Builder <= 3.21.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-28038 affects the Ultimate VC Addons plugin (up to version 3.21.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-28037: EventON <= 4.9.12 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28037 affects the EventON plugin for WordPress (up to 4.9.12) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure you update to the patched version to mitigate potential attacks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.