AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-26
CVE-2026-28133: Filr – Secure document library <= 1.2.13 – Authenticated (Contributor+) Arbitrary File Uploads (filr-protection)
The Filr – Secure document library plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code…
2026-02-26
CVE-2026-28134: JetEngine <= 3.7.2 – Authenticated (Contributor+) Remote Code Execution (jet-engine)
The JetEngine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
2026-02-26
CVE-2024-10938: OVRI Payment 1.7.0 – Malicious .htaccess directive (moneytigo)
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.
2026-02-26
CVE-2025-14149: Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 – Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link (xpro-elementor-addons)
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Scroller widget box link attribute in all versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level…
2026-02-26
CVE-2026-28122: ListingPro Plugin <= 2.9.8 – Reflected Cross-Site Scripting (listingpro-plugin)
The ListingPro Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such…
2026-02-26
CVE-2026-2428: Fluent Forms Pro Add On Pack <= 6.1.17 – Missing Authorization to Unauthenticated Payment Status modification (fluentformpro)
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.1.17. This is due to the PayPal IPN (Instant Payment Notification) verification being disabled by default (`disable_ipn_verification` defaults to `'yes'` in `PayPalSettings.php`). This makes it possible for unauthenticated attackers to…
2026-02-26
CVE-2026-2383: Simple Download Monitor <= 4.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (simple-download-monitor)
The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever…
2026-02-26
CVE-2025-14142: Electric Enquiries <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute (electric-enquiries)
The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages…
2026-02-26
CVE-2026-1558: WP Recipe Maker <= 10.3.2 – Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter (wp-recipe-maker)
The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for…
2026-02-26
CVE-2026-2362: WP Accessibility <= 2.3.1 – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute (wp-accessibility)
The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.