AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14149: Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link PoC, Patch Analysis & Rule
CVE-2025-14149 affects the Xpro Elementor Addons plugin (up to v1.4.24) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can exploit this flaw, so patching is essential for security.
March 18, 2026
CVE-2024-10938: OVRI Payment 1.7.0 Malicious .htaccess directive PoC, Patch Analysis & Rule
CVE-2024-10938 affects the Moneytigo plugin (v1.7.0) with a medium severity (CVSS 6.5). Malicious .htaccess files can block legitimate scripts. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-28134: JetEngine <= 3.7.2 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-28134 affects Jet Engine plugin versions up to 3.7.2, allowing remote code execution for authenticated users. With a CVSS score of 8.8, it's crucial to update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-28133: Filr – Secure document library <= 1.2.13 Authenticated (Contributor+) Arbitrary File Uploads PoC, Patch Analysis & Rule
CVE-2026-28133 affects the Filr Protection plugin (v1.2.13 and below) with a CVSS score of 8.8. It allows authenticated users to upload arbitrary files, risking remote code execution. Update to v1.2.14 to mitigate this vulnerability.
March 18, 2026
CVE-2026-28135: Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-28135 affects the Royal Elementor Addons plugin (up to v1.7.1049) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v1.7.1050 to mitigate this issue.
March 18, 2026
CVE-2026-28078: Directory Listings WordPress plugin – uListing <= 2.2.0 Authenticated (Editor+) Arbitrary File Download PoC, Patch Analysis & Rule
CVE-2026-28078 affects the uListing WordPress plugin (up to version 2.2.0) with a medium severity CVSS of 4.9. Authenticated attackers can exploit this file upload vulnerability to access sensitive server files. Patching is recommended.
March 18, 2026
CVE-2026-28112: AllInOne Banner Rotator <= 3.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28112 affects the All In One BannerRotator plugin (up to version 3.8) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-28115: WP Attractive Donations System Easy Stripe & Paypal donations <= 1.25 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-28115 affects the WP Attractive Donations System plugin (up to v1.25) with a high severity (CVSS 7.5) SQL injection vulnerability. Unauthenticated attackers can exploit this flaw to access sensitive database information...
March 18, 2026
CVE-2026-28108: LambertGroup AllInOne Banner with Thumbnails <= 3.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28108 affects the All In One ThumbnailsBanner plugin for WordPress, with a medium severity CVSS score of 6.1. Users should update from version 3.8 to mitigate the reflected XSS risk from insufficient input sanitization.
March 18, 2026
CVE-2026-28113: Ultimate Learning Pro <= 3.9.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28113 affects the Indeed Learning Pro plugin (v3.9.1) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure to update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-28127: Lawyer Directory <= 1.3.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28127 affects the Lawyer Directory plugin for WordPress (up to v1.3.2) with a high severity CVSS score of 7.2 due to stored XSS. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-28109: LambertGroup AllInOne Content Slider <= 3.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28109 affects the All In One ContentSlider plugin for WordPress (up to version 3.8) with a medium severity (CVSS 6.1) XSS vulnerability. Users should update to the patched version to mitigate risks from potential script injections.
March 18, 2026
CVE-2026-28110: LambertGroup AllInOne Banner with Playlist <= 3.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28110 affects the All In One BannerWithPlaylist plugin for WordPress, with a CVSS score of 6.1. Users should update from version 3.8 to mitigate reflected XSS risks from insufficient input sanitization.
March 18, 2026
CVE-2026-28104: Site Suggest <= 1.3.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-28104 affects the Site Suggest plugin for WordPress (up to version 1.3.9) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2026-28103: Responsive Zoom In/Out Slider WordPress Plugin <= 5.4.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28103 affects the Lbg_zoominoutslider plugin (up to version 5.4.5) with a medium severity CVSS score of 6.1. Ensure proper input sanitization to mitigate reflected XSS risks.
March 18, 2026
CVE-2026-23799: Tutor LMS – eLearning and online course solution <= 3.9.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-23799 affects Tutor LMS plugin versions up to 3.9.5, allowing authenticated users to perform unauthorized actions. Update to version 3.9.6 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-22390: Builderall for WordPress <= 3.0.1 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-22390 affects the Builderall Cheetah For WP plugin (up to version 3.0.1) with a high severity score of 8.8. Authenticated attackers can execute remote code, making immediate patching essential.
March 18, 2026
CVE-2026-2506: EM Cost Calculator <= 2.3.1 Unauthenticated Stored Cross-Site Scripting via 'customer_name' PoC, Patch Analysis & Rule
CVE-2026-2506 affects the Cost Calculator plugin for WordPress (up to v2.3.1) with a medium severity (CVSS 6.1) stored XSS vulnerability. Unauthenticated attackers can inject scripts, impacting admin security. Patching is essential.
March 18, 2026
CVE-2026-27354: WooCommerce Coming Soon Product with Countdown <= 5.0 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27354 affects the Woo Coming Soon Product plugin for WordPress (up to v5.0) with a CVSS score of 6.4. Authenticated users can exploit this medium-severity XSS vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2026-23802: AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.3.2 Authenticated (Editor+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-23802 reveals a high-severity file upload vulnerability in the Ai Engine plugin (versions up to 3.3.2). Update to 3.3.3 to mitigate risks of arbitrary file uploads and potential remote code execution.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.