AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
July 1, 2026
CVE-2026-13252: RSS Aggregator by Feedzy <= 5.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute PoC, Patch Analysis & Rule
CVE-2026-13252 affects the Feedzy Rss Feeds plugin (up to v5.2.1) with a CVSS score of 6.4. This medium-severity Stored XSS vulnerability allows authenticated users to inject scripts. Update to v5.2.2 to mitigate risks.
July 1, 2026
CVE-2026-10104: Product Video Gallery for Woocommerce <= 1.5.1.8 Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter PoC, Patch Analysis & Rule
CVE-2026-10104 affects the Product Video Gallery Slider for WooCommerce plugin (v1.5.1.8) with a medium severity (CVSS 4.4) XSS vulnerability. Update to v1.5.1.9 to mitigate risks from authenticated attacks.
July 1, 2026
CVE-2026-9188: Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.6 Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter PoC, Patch Analysis & Rule
CVE-2026-9188 affects the Wappointment plugin for WordPress (up to 2.7.6) with a CVSS score of 5.3. Unauthenticated users can exploit predictable keys to cancel or reschedule appointments. Update to version 2.7.7 to mitigate.
July 1, 2026
CVE-2026-12122: Kirki <= 6.0.11 Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action PoC, Patch Analysis & Rule
CVE-2026-12122 affects the Kirki plugin (up to version 6.0.11) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated access to sensitive data. Upgrade to version 6.0.12 to mitigate this risk.
July 1, 2026
CVE-2026-12657: LatePoint <= 5.6.2 Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter PoC, Patch Analysis & Rule
CVE-2026-12657 affects LatePoint plugin versions up to 5.6.2, allowing unauthenticated users to create unauthorized bookings. Update to version 5.6.3 to mitigate this medium severity vulnerability.
July 1, 2026
CVE-2026-13459: JetFormBuilder <= 3.6.3 Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter PoC, Patch Analysis & Rule
CVE-2026-13459 affects JetFormBuilder plugin versions up to 3.6.3, allowing unauthenticated access to sensitive WooCommerce PII due to an authentication bypass. Update to version 3.6.3.1 to mitigate this medium severity issue.
July 1, 2026
CVE-2026-11896: My Calendar <= 3.7.14 Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter PoC, Patch Analysis & Rule
CVE-2026-11896 affects the My Calendar plugin for WordPress (up to version 3.7.14) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive event data; update to version 3.7.15 to mitigate this risk.
July 1, 2026
CVE-2026-14029: Groundhogg <= 4.5.8 Authenticated (Custom+) SQL Injection via 'select' Parameter PoC, Patch Analysis & Rule
CVE-2026-14029 affects Groundhogg plugin versions up to 4.5.8, allowing SQL injection by authenticated users with custom roles. Update to version 4.5.9 to mitigate this medium severity vulnerability.
July 1, 2026
CVE-2026-12134: JoomSport <= 5.7.8 Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action PoC, Patch Analysis & Rule
CVE-2026-12134 affects the Joomsport Sports League Results Management plugin (up to v5.7.8) with a medium severity (CVSS 4.3) authentication bypass. Patch to v5.7.9 to prevent unauthorized modifications by attackers.
July 1, 2026
CVE-2026-12472: Kirki <= 6.0.11 Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters PoC, Patch Analysis & Rule
CVE-2026-12472 affects the Kirki plugin (up to v6.0.11) with a medium severity (CVSS 5.3) authentication bypass. Update to v6.0.12 to mitigate risks of unauthorized email injection attacks.
July 1, 2026
CVE-2026-10089: Insert Pages <= 3.11.4 Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names) PoC, Patch Analysis & Rule
CVE-2026-10089 affects the Insert Pages plugin for WordPress (up to version 3.11.4) with a medium severity XSS vulnerability. Update to version 3.11.5 to mitigate risks from authenticated attackers injecting scripts.
July 1, 2026
CVE-2026-11592: Email Subscribers & Newsletters <= 5.9.27 Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action PoC, Patch Analysis & Rule
CVE-2026-11592 affects the Email Subscribers plugin (up to version 5.9.27) with a CVSS score of 4.3. Authenticated attackers can exploit this medium-severity vulnerability to manipulate mail settings. Upgrade to 5.9.28 to mitigate risks.
July 1, 2026
CVE-2026-5821: Image Optimizer <= 1.7.4 Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection PoC, Patch Analysis & Rule
CVE-2026-5821 affects the Image Optimization plugin (up to v1.7.4) with a CVSS score of 8.1. Authenticated attackers can exploit a file upload vulnerability to delete arbitrary files. Upgrade to v1.7.5 to mitigate this risk.
July 1, 2026
CVE-2026-13357: Houzez Property Feed <= 2.5.46 Authenticated (Administrator+) SQL Injection via 'orderby' Parameter PoC, Patch Analysis & Rule
CVE-2026-13357 affects the Houzez Property Feed plugin (up to version 2.5.46) with a medium severity SQL injection vulnerability (CVSS 4.9). Users should update to version 2.5.47 to mitigate risks associated with this flaw.
July 1, 2026
CVE-2026-13704: GiveWP <= 4.16.1 Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form PoC, Patch Analysis & Rule
CVE-2026-13704 affects the GiveWP plugin (up to version 4.16.1) with a medium severity CVSS score of 6.4. Patch to version 4.16.2 to mitigate Stored XSS risks from authenticated attackers injecting scripts.
July 1, 2026
CVE-2026-14249: Request a Quote Form Plugin <= 2.5.5 Unauthenticated Code Injection via 'path' Parameter PoC, Patch Analysis & Rule
CVE-2026-14249 affects the Request A Quote plugin for WordPress (up to version 2.5.5) with a CVSS score of 7.5. Unauthenticated code injection is possible; update to version 2.5.6 to mitigate this high-severity vulnerability.
July 1, 2026
CVE-2026-32488: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 Unauthenticated Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-32488 affects the User Registration plugin for WordPress, allowing remote code execution in versions up to 4.4.9. With a CVSS score of 9.8, users should upgrade to version 5.1.3 to mitigate this critical vulnerability.
June 30, 2026
CVE-2026-10095: WP Photo Album Plus <= 9.1.13.005 Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-10095 affects the WP Photo Album Plus plugin (up to 9.1.13.005) with a CVSS score of 6.4. Authenticated users can exploit stored XSS via the 'subtext' parameter. Update to version 9.2.01.001 to mitigate this risk.
June 30, 2026
CVE-2026-13228: LatePoint <= 5.6.3 Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter PoC, Patch Analysis & Rule
CVE-2026-13228 affects the LatePoint plugin (up to version 5.6.3) with a CVSS score of 8.8. Authenticated attackers can escalate privileges to Administrator. Update to version 5.6.4 to mitigate this vulnerability.
June 30, 2026
CVE-2026-12142: NEX-Forms <= 9.2.2 Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter PoC, Patch Analysis & Rule
CVE-2026-12142 affects the Nex Forms Express WP Form Builder plugin (up to 9.2.2) with a high severity CVSS score of 7.2. Unauthenticated XSS vulnerabilities can be mitigated by updating to version 9.2.3.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.