AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-0735: User Language Switch <= 1.6.10 Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter PoC, Patch Analysis & Rule
CVE-2026-0735 affects the User Language Switch plugin for WordPress (up to 1.6.10) with a medium severity CVSS of 4.4. Authenticated attackers can exploit this XSS vulnerability, so patching is essential for affected installations.
March 18, 2026
CVE-2025-14852: MDirector Newsletter <= 4.5.8 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14852 affects the MDirector Newsletter plugin for WordPress (up to 4.5.8) with a medium severity CVSS score of 4.3. Patch to version 4.5.10 to mitigate unauthorized settings changes via Cross-Site Request Forgery.
March 18, 2026
CVE-2026-1303: MailChimp Campaigns <= 3.2.4 Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection PoC, Patch Analysis & Rule
CVE-2026-1303 affects the Olalaweb Mailchimp Campaign Manager plugin (up to v3.2.4) with a medium severity (CVSS 5.3) flaw allowing authenticated users to disrupt MailChimp sync. Patching is essential to maintain marketing automation.
March 18, 2026
CVE-2026-0751: Payment Page | Payment Form for Stripe <= 1.4.6 Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter PoC, Patch Analysis & Rule
CVE-2026-0751 affects the Payment Page plugin for WordPress (up to 1.4.6) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to version 1.4.7 to mitigate risks of script injection by authenticated users.
March 18, 2026
CVE-2026-1987: Scheduler Widget <= 0.1.6 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification PoC, Patch Analysis & Rule
CVE-2026-1987 affects the Scheduler Widget plugin for WordPress (up to version 0.1.6) with a medium severity (CVSS 5.4) vulnerability. Authenticated users can exploit it to modify events, so ensure timely patching.
March 18, 2026
CVE-2026-1795: Address Bar Ads <= 1.0.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1795 affects the Address Bar Ads plugin for WordPress (up to 1.0.0) with a medium severity CVSS score of 6.1. Users should patch to mitigate the reflected XSS risk that allows script injection.
March 18, 2026
CVE-2026-1796: StyleBidet <= 1.0.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1796 affects the StyleBidet WordPress plugin (up to 1.0.0) with a CVSS score of 6.1. This medium severity XSS vulnerability allows attackers to inject scripts via insufficient input sanitization. Patching is essential.
March 18, 2026
CVE-2026-1939: Percent to Infograph <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1939 affects the Percent To Infograph plugin for WordPress (v1.0) with a CVSS score of 6.4. Authenticated attackers can exploit this medium severity XSS vulnerability, highlighting the need for immediate patching.
March 18, 2026
CVE-2026-1901: QuestionPro Surveys <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1901 affects the QuestionPro Surveys plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Patching is essential.
March 18, 2026
CVE-2026-0753: Super Simple Contact Form <= 1.6.2 Reflected Cross-Site Scripting via 'sscf_name' Parameter PoC, Patch Analysis & Rule
CVE-2026-0753 affects the Super Simple Contact Form plugin (up to v1.6.2) with a high severity CVSS score of 7.2 due to reflected XSS. Ensure you patch to mitigate risks from potential script injections.
March 18, 2026
CVE-2026-1944: CallbackKiller service widget <= 1.2 Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2026-1944 affects the Callbackkiller Service Widget plugin for WordPress (v1.2). This medium severity vulnerability allows unauthenticated attackers to modify site ID settings. Users should patch to mitigate risks.
March 18, 2026
CVE-2025-14873: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-14873 affects the LatePoint plugin for WordPress (up to v5.2.5) with a medium severity CVSS score of 4.3. Patching to v5.2.6 is crucial to mitigate the Cross-Site Request Forgery risk.
March 18, 2026
CVE-2026-1905: Sphere Manager <= 1.0.2 Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1905 affects the Sphere Manager plugin for WordPress (up to 1.0.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can exploit this to inject scripts, highlighting the need for immediate...
March 18, 2026
CVE-2026-0559: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0559 affects the MasterStudy LMS plugin (up to version 3.7.11) with a medium severity CVSS score of 6.4. Patching to version 3.7.12 is essential to mitigate stored XSS risks from authenticated users.
March 18, 2026
CVE-2026-0727: Accordion and Accordion Slider <= 1.4.5 Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification PoC, Patch Analysis & Rule
CVE-2026-0727 affects the Accordion And Accordion Slider plugin (up to v1.4.5) with a medium severity (CVSS 5.4) authentication bypass. Patch to v1.4.6 to secure attachment metadata from unauthorized modifications.
March 18, 2026
CVE-2026-1988: Flexi Product Slider and Grid for WooCommerce <= 1.0.5 Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1988 affects the Flexi Product Slider Grid plugin (v1.0.5) with a CVSS score of 7.5. Authenticated attackers can exploit this high-severity local file inclusion vulnerability. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-0557: WP Data Access <= 5.5.63 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0557 affects the WP Data Access plugin (up to version 5.5.63) with a CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability. Update to version 5.5.64 to mitigate risks.
March 18, 2026
CVE-2026-0693: Allow HTML in Category Descriptions <= 1.2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions PoC, Patch Analysis & Rule
CVE-2026-0693 affects the Allow HTML in Category Descriptions plugin (up to v1.2.4) with a medium severity (CVSS 4.4) XSS vulnerability. Update to v1.2.5 to mitigate risks from authenticated attacks.
March 18, 2026
CVE-2025-6792: One to one user Chat by WPGuppy <= 1.1.4 Unauthenticated Information Disclosure via Chat Message Interception PoC, Patch Analysis & Rule
CVE-2025-6792 affects Wpguppy Lite plugin versions up to 1.1.4, allowing unauthenticated users to access private chat messages. Upgrade to 1.1.5 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-1187: ZoomifyWP Free <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1187 affects the Tz Zoomifywp Free plugin (v1.1) with a CVSS score of 6.4. This medium severity stored XSS vulnerability allows authenticated attackers to inject scripts. Users should update to the patched version to mitigate...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.