AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1671: Activity Log for WordPress <= 1.2.8 Missing Authorization to Sensitive Information Exposure via Log File PoC, Patch Analysis & Rule
CVE-2026-1671 affects the Winterlock plugin (up to 1.2.8) with a CVSS score of 6.5. It allows authenticated users to access sensitive data due to a missing capability check. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-1356: Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 Unauthenticated Server-Side Request Forgery via src PoC, Patch Analysis & Rule
CVE-2026-1356 affects the Webp Converter For Media plugin (up to v6.5.1) with a medium severity CVSS score of 4.8. Unauthenticated SSRF vulnerabilities can lead to unauthorized access to internal services; patching is essential.
March 18, 2026
CVE-2025-69394: Cnvrse <= 026.02.10.20 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-69394 affects the Cnvrse WordPress plugin (up to version 026.02.10.20) with a medium severity (CVSS 5.3) vulnerability. Unauthenticated attackers can exploit this IDOR issue; ensure you update to the patched version.
March 18, 2026
CVE-2026-1537: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 Missing Authorization to Booking Details Exposure PoC, Patch Analysis & Rule
CVE-2026-1537 affects the LatePoint plugin (up to v5.2.6) with a medium severity score of 5.3. Unauthenticated attackers can access sensitive booking data. Update to v5.2.7 to mitigate this vulnerability.
March 18, 2026
CVE-2026-25036: Passster <= 4.2.25 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25036 affects the Content Protector plugin for WordPress (up to version 4.2.25) with a medium severity CVSS score of 4.3. Ensure you update to version 4.2.26 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68501: Mollie Payments for WooCommerce <= 8.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68501 affects the Mollie Payments for WooCommerce plugin (up to version 8.1.1) with a medium severity CVSS score of 6.1. Users should upgrade to version 8.1.2 to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2025-68495: JetEngine <= 3.8.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68495 affects the Jet Engine plugin for WordPress (up to 3.8.0) with a CVSS score of 6.1. This medium-severity reflected XSS vulnerability can be exploited by unauthenticated attackers, making it crucial to patch or mitigate.
March 18, 2026
CVE-2026-1787: LearnPress Export Import <= 4.1.0 Missing Authentication to Unauthenticated Migrated Course Deletion PoC, Patch Analysis & Rule
CVE-2026-1787 affects the LearnPress Import Export plugin (up to 4.1.0) with a CVSS score of 4.8. Unauthenticated attackers can delete migrated courses when Tutor LMS is active. Update to version 4.1.1 to mitigate this risk.
March 18, 2026
CVE-2026-2608: Gutenberg Blocks by Kadence Blocks <= 3.5.32 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-2608 affects the Kadence Blocks plugin (up to 3.5.32) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this flaw to perform unauthorized actions. Update to version 3.6.0 to mitigate risks.
March 18, 2026
CVE-2026-22352: Persian Woocommerce SMS <= 7.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-22352 affects the Persian Woocommerce SMS plugin (up to 7.1.1) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2026-24959: JS Help Desk <= 3.0.1 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-24959 affects the JS Support Ticket plugin (up to 3.0.1) with a medium severity SQL injection vulnerability (CVSS 6.5). Update to version 3.0.2 to mitigate risks from authenticated attackers exploiting this flaw.
March 18, 2026
CVE-2025-68514: Paid Member Subscriptions <= 2.16.8 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-68514 affects the Paid Member Subscriptions plugin (up to 2.16.8) with a medium severity (CVSS 4.3) vulnerability. Update to version 2.16.9 to mitigate unauthorized actions by authenticated users.
March 18, 2026
CVE-2026-22351: FullCalendar <= 1.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22351 affects the Wp Fullcalendar plugin (up to version 1.6) with a medium severity score of 5.3. Unauthenticated attackers can exploit this flaw for unauthorized actions. Ensure you update to the patched version.
March 18, 2026
CVE-2025-69063: New User Approve <= 3.2.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69063 affects the New User Approve plugin for WordPress, versions up to 3.2.0, with a medium severity CVSS score of 5.3. Update to version 3.2.1 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68534: PDF for WPForms <= 6.3.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68534 affects the PDF for WPForms plugin (up to v6.3.0) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this flaw for unauthorized actions. Users should update to the patched version for protection.
March 18, 2026
CVE-2026-22350: PDF for Elementor Forms + Drag And Drop Template Builder <= 6.3.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22350 affects the PDF for Elementor Forms plugin (up to v6.3.1) with a medium severity (CVSS 4.3) vulnerability. Update to v6.5.0 to mitigate unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-15400: OpenPix <= 2.13.3 Missing Authorization to Authenticated (Subscriber+) Settings Update PoC, Patch Analysis & Rule
CVE-2025-15400 affects the OpenPix for WooCommerce plugin (up to v2.13.3) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Upgrade to v2.13.4 to mitigate this risk.
March 18, 2026
CVE-2026-24956: Download Manager Addons for Elementor <= 1.3.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-24956 affects the Wpdm Elementor plugin (up to 1.3.0) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to access sensitive data. Patch immediately.
March 18, 2026
CVE-2026-22346: Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.5.4 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-22346 affects the Slider Responsive Slideshow plugin (v1.5.4) with a CVSS score of 7.5. Authenticated attackers can exploit a file upload vulnerability, leading to potential code execution. Patching is essential for security.
March 18, 2026
CVE-2026-1104: FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 Missing Authorization to Authenticated (Contributor+) Backup Creation and Download PoC, Patch Analysis & Rule
CVE-2026-1104 affects the Fastdup plugin (up to v2.7.1) with a high severity CVSS score of 8.8. Authenticated users can exploit this to create unauthorized full-site backups. Update to v2.7.2 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.