AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69401: WooODT Lite <= 2.5.2 Unauthenticated Payment Bypass PoC, Patch Analysis & Rule
CVE-2025-69401 affects the Byconsole Woo Order Delivery Time plugin (up to v2.5.2) with a medium severity score of 5.3. Unauthenticated attackers can bypass payments, so ensure you update to the patched version.
March 18, 2026
CVE-2025-69392: iMoney <= 0.36 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69392 affects the iMoney WordPress plugin (up to version 0.36) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the risk of reflected XSS attacks.
March 18, 2026
CVE-2025-69403: Bravis Addons <= 1.1.9 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-69403 affects the Bravis Addons plugin for WordPress, with a high CVSS score of 8.8. Authenticated users can exploit a file upload vulnerability, risking remote code execution. Update to the patched version to mitigate.
March 18, 2026
CVE-2025-68526: Modal Popup Box <= 1.6.1 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-68526 affects the Modal Popup Box plugin for WordPress (up to version 1.6.1) with a high severity CVSS score of 7.5. Authenticated attackers can exploit this file upload vulnerability; update to version 1.6.2 to mitigate risks.
March 18, 2026
CVE-2026-2295: WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 Unauthenticated Protected Post Exposure via ajax_post_grid_load_more PoC, Patch Analysis & Rule
CVE-2026-2295 affects WPZOOM Elementor Addons plugin version 1.3.2, allowing unauthorized access to draft and pending post data. Upgrade to version 1.3.3 to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2025-15096: Videospirecore Theme Plugin <= 1.0.6 Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover PoC, Patch Analysis & Rule
CVE-2025-15096 affects the Videospirecore plugin for WordPress, allowing authenticated attackers to escalate privileges and take over accounts. With a CVSS score of 8.8, users should update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-22345: Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-22345 affects the New Image Gallery plugin for WordPress (up to 1.6.0) with a high severity CVSS score of 7.5. Patch to version 1.6.1 to mitigate the risk of PHP Object Injection by authenticated users.
March 18, 2026
CVE-2026-1853: BuddyHolis ListSearch <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1853 affects the Listsearch plugin for WordPress (up to v1.1) with a CVSS score of 6.4. This medium-severity XSS vulnerability allows authenticated attackers to inject scripts. Users should update to the patched version to...
March 18, 2026
CVE-2026-1748: Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 Missing Authorization to Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-1748 affects the Kirilkirkov Pdf Invoice Manager plugin (up to v1.6) with a CVSS score of 4.3. Authenticated users can exploit this remote code execution flaw to access sensitive data. Upgrade to v1.7 to mitigate risks.
March 18, 2026
CVE-2026-1804: WDES Responsive Popup <= 1.3.6 Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1804 affects the Wdes Responsive Popup plugin (up to v1.3.6) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Ensure you update to the patched version.
March 18, 2026
CVE-2026-1827: IDE Micro code-editor <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1827 affects the Flask Micro plugin for WordPress (up to version 1.0.0) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so patching is crucial to prevent script injection.
March 18, 2026
CVE-2026-1215: MMA Call Tracking <= 2.3.15 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2026-1215 affects the MMA Call Tracking plugin for WordPress (up to version 2.3.15) with a medium severity CVSS score of 4.3. Ensure to patch to prevent unauthorized configuration changes via CSRF attacks.
March 18, 2026
CVE-2026-0724: WPlyr Media Block <= 1.3.0 Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter PoC, Patch Analysis & Rule
CVE-2026-0724 affects the WPlyr Media Block plugin (up to v1.3.0) with a CVSS score of 4.4. Authenticated attackers can exploit stored XSS vulnerabilities. Patching is recommended to mitigate risks.
March 18, 2026
CVE-2025-15440: iONE360 configurator <= 2.0.57 Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters PoC, Patch Analysis & Rule
CVE-2025-15440 affects the Ione360 Configurator plugin for WordPress (up to version 2.0.57) with a CVSS score of 7.2. Unauthenticated stored XSS can be exploited via contact form parameters; patching is essential.
March 18, 2026
CVE-2026-1885: Slideshow Wp <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute PoC, Patch Analysis & Rule
CVE-2026-1885 affects the Slideshow Wp plugin (up to version 1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2026-1809: HTML Shortcodes <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1809 affects the Html Shortcodes plugin for WordPress, with a CVSS score of 6.4. Users should update to the patched version to mitigate the risk of stored XSS attacks from authenticated users.
March 18, 2026
CVE-2026-1826: OpenPOS Lite <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1826 affects OpenPOS Lite Version 3.0, allowing authenticated attackers to exploit a stored XSS vulnerability with a CVSS score of 6.4. Upgrade to version 3.1 to mitigate this risk.
March 18, 2026
CVE-2026-28114: WooCommerce License Manager <= 7.0.6 Authenticated (Shop Manager+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-28114 affects the Fs License Manager plugin for WordPress (up to v7.0.6) with a high severity CVSS score of 7.2. Authenticated attackers can exploit this file upload vulnerability, risking remote code execution. Patching is...
March 18, 2026
CVE-2026-28126: RH Frontend Publishing Pro <= 4.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-28126 affects the RH Frontend Publishing Pro plugin (up to version 4.3.2) with a medium severity CVSS score of 6.1. Ensure to patch to avoid cross-site scripting risks from unauthenticated attackers.
March 18, 2026
CVE-2026-1311: Worry Proof Backup <= 0.2.4 Authenticated (Subscriber+) Path Traversal via Backup Upload PoC, Patch Analysis & Rule
CVE-2026-1311 affects the Worry Proof Backup plugin for WordPress (up to 0.2.4) with a CVSS score of 8.8. Authenticated attackers can exploit a path traversal vulnerability to execute arbitrary code. Update to the patched version.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.