AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1542: Super Stage WP <= 1.0.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-1542 affects the Super Stage WP plugin (up to v1.0.1) with a high severity (CVSS 8.1) file upload vulnerability. Update to v1.0.2 to mitigate risks of PHP Object Injection and potential unauthorized access.
March 18, 2026
CVE-2025-13673: Tutor LMS <= 3.9.6 Unauthenticated SQL Injection via coupon_code PoC, Patch Analysis & Rule
CVE-2025-13673 affects Tutor LMS versions up to 3.9.6, allowing unauthenticated SQL injection with a CVSS score of 7.5. Upgrade to 3.9.7 to mitigate risks of sensitive data exposure.
March 18, 2026
CVE-2026-2471: WP Mail Logging <= 1.15.0 Unauthenticated PHP Object Injection via Email Log Message Field PoC, Patch Analysis & Rule
CVE-2026-2471 affects WP Mail Logging plugin versions up to 1.15.0, with a CVSS score of 7.5. Unauthenticated attackers can exploit a file upload vulnerability. Update to version 1.16.0 to mitigate risks.
March 18, 2026
CVE-2026-28071: pixfort Core <= 3.2.22 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-28071 affects the Pixfort Core plugin (up to version 3.2.22) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this to perform unauthorized actions; ensure you update to the patched version.
March 18, 2026
CVE-2026-27983: LMS Elementor Pro <= 1.0.4 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-27983 affects the LMS Elementor Pro plugin (up to version 1.0.4) with a critical CVSS score of 9.8, allowing unauthenticated privilege escalation. Users should update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-28072: pixfort Core <= 3.2.22 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28072 affects the Pixfort Core plugin (up to v3.2.22) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential script injection attacks.
March 18, 2026
CVE-2026-28102: UberSlider Classic <= 2.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28102 affects the UberSlider Classic plugin for WordPress (version 2.5 and earlier) with a medium severity (CVSS 6.1) XSS vulnerability. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-28100: UberSlider PerpetuumMobile <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28100 affects the UberSlider PerpetuumMobile plugin (up to version 2.3) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should implement input sanitization and consider WAF coverage until a patch is released.
March 18, 2026
CVE-2026-2269: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-2269 affects the Uncanny Automator plugin (up to version 7.0.0.3) with a CVSS score of 7.2. Admins should upgrade to version 7.1.0 to mitigate a high-severity file upload vulnerability that could lead to remote code execution.
March 18, 2026
CVE-2026-28099: UberSlider Ultra <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28099 affects the UberSlider Ultra plugin for WordPress (up to version 2.3) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected XSS risks.
March 18, 2026
CVE-2026-28101: UberSlider MouseInteraction <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28101 affects the UberSlider MouseInteraction plugin (up to version 2.3) with a medium severity CVSS score of 6.1. Users should patch to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2026-27984: Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.1.3 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-27984 affects the Widget Options plugin (up to version 4.1.3) with a CVSS score of 8.8. It allows remote code execution by authenticated users. Upgrade to version 4.2.0 to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2026-2831: MailArchiver <= 4.5.0 Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter PoC, Patch Analysis & Rule
CVE-2026-2831 affects the Mailarchiver plugin (up to v4.5.0) with a medium severity score of 4.9. Admin-level users should update to v4.5.1 to mitigate SQL injection risks that could expose sensitive database information.
March 18, 2026
CVE-2026-1305: Japanized for WooCommerce <= 2.8.4 Missing Authorization to Unauthenticated Paidy Order Manipulation PoC, Patch Analysis & Rule
CVE-2026-1305 affects the Woocommerce For Japan plugin (up to 2.8.4) with a medium severity (CVSS 5.3) remote code execution vulnerability. Update to version 2.8.5 to mitigate unauthorized payment processing risks.
March 18, 2026
CVE-2026-2362: WP Accessibility <= 2.3.1 Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute PoC, Patch Analysis & Rule
CVE-2026-2362 affects the WP Accessibility plugin (up to version 2.3.1) with a medium severity (CVSS 6.4) XSS vulnerability. Patch to version 2.3.2 to mitigate risks from authenticated attackers exploiting the 'Long Description UI' feature.
March 18, 2026
CVE-2026-1558: WP Recipe Maker <= 10.3.2 Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter PoC, Patch Analysis & Rule
CVE-2026-1558 affects the WP Recipe Maker plugin (up to version 10.3.2) with a medium severity (CVSS 5.3) vulnerability. Users should upgrade to version 10.3.3 to prevent unauthorized access to post metadata.
March 18, 2026
CVE-2025-14142: Electric Enquiries <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14142 affects the Electric Enquiries plugin (up to v1.1) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure to update to the patched version to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2026-2383: Simple Download Monitor <= 4.0.5 Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field PoC, Patch Analysis & Rule
CVE-2026-2383 affects the Simple Download Monitor plugin (up to v4.0.5) with a medium severity (CVSS 6.4) cross-site scripting vulnerability. Users should update to v4.0.6 to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2026-2428: Fluent Forms Pro Add On Pack <= 6.1.17 Missing Authorization to Unauthenticated Payment Status modification PoC, Patch Analysis & Rule
CVE-2026-2428 affects the Fluent Forms Pro plugin (up to v6.1.17) with a CVSS score of 7.5. It allows unauthenticated attackers to manipulate payment notifications. Ensure you update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-28122: ListingPro Plugin <= 2.9.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28122 affects the ListingPro Plugin for WordPress (up to version 2.9.8) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.