AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 28, 2026
CVE-2026-54818: SlimStat Analytics <= 5.4.11 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54818 affects the SlimStat Analytics plugin for WordPress (up to 5.4.11) with a medium severity CVSS score of 6.5. Authenticated users can exploit SQL injection vulnerabilities; update to 5.4.12 to mitigate risks.
June 28, 2026
CVE-2026-54814: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 Authenticated (Subscriber+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-54814 affects the Motors Car Dealership Classified Listings plugin (up to v1.4.109) with a CVSS score of 7.5. Patch to v1.4.110 to mitigate the high-risk Local File Inclusion vulnerability that allows unauthorized file execution.
June 28, 2026
CVE-2026-54824: Quads Ads Manager for Google AdSense <= 3.0.3 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-54824 affects Quick Adsense Reloaded plugin versions up to 3.0.3 with a medium severity (CVSS 5.3). Patch to version 3.0.4 to mitigate sensitive information exposure risks.
June 28, 2026
CVE-2026-54826: SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-54826 affects the SupportCandy plugin (up to v3.4.6) with a CVSS score of 4.3. Authenticated users can exploit this IDOR vulnerability, so upgrade to v3.4.7 to mitigate risks.
June 28, 2026
CVE-2026-54812: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54812 affects the Motors Car Dealership Classified Listings plugin for WordPress (up to version 1.4.109) with a CVSS score of 7.5. Unauthenticated SQL injection can lead to data exposure; upgrade to version 1.4.110 to mitigate.
June 28, 2026
CVE-2026-54825: wpDataTables (Premium) <= 7.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54825 reveals a high-severity SQL injection vulnerability in the wpDataTables plugin for WordPress, affecting versions up to 7.4. Unauthenticated attackers can exploit this flaw to access sensitive database information.
June 28, 2026
CVE-2026-54830: Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-54830 affects the Restaurant Reservations plugin (up to v2.7.19) with a CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability. Update to v2.7.20 to mitigate the risk.
June 28, 2026
CVE-2026-54834: Object Cache 4 everyone <= 2.3.2 Information Exposure PoC, Patch Analysis & Rule
CVE-2026-54834 affects Object Cache 4 Everyone plugin versions up to 2.3.2, exposing sensitive data to unauthenticated attackers. Upgrade to 2.3.3 to mitigate this medium severity vulnerability (CVSS 5.3).
June 28, 2026
CVE-2026-54828: Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-54828 affects the Motors Car Dealership Classified Listings plugin (up to v1.4.109) with a medium severity (CVSS 5.3) vulnerability. Patch to v1.4.110 to prevent unauthorized access by attackers.
June 28, 2026
CVE-2026-54822: SALESmanago & Leadoo <= 3.11.2 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54822 affects the SALESmanago plugin (up to version 3.11.2) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to version 3.11.3 to mitigate the risk of data exposure.
June 28, 2026
CVE-2026-54813: SureDash – Community, Courses & Member Dashboard <= 1.8.0 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54813 affects the SureDash plugin for WordPress (up to v1.8.0) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to v1.8.1 to mitigate risks of data exposure.
June 28, 2026
CVE-2026-54820: JetBooking <= 4.0.4.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54820 affects the Jet Booking plugin for WordPress (up to v4.0.4.1) with a high severity CVSS score of 7.5. Unauthenticated SQL injection allows attackers to access sensitive data; patch immediately.
June 28, 2026
CVE-2026-54831: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54831 affects the GeoDirectory plugin (up to version 2.8.162) with a high severity SQL injection vulnerability (CVSS 7.5). Update to version 2.8.163 to mitigate risks of unauthorized data access.
June 28, 2026
CVE-2026-54816: Advanced Ads – Ad Manager & AdSense <= 2.0.21 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-54816 affects the Advanced Ads plugin for WordPress (up to version 2.0.21) with a CVSS score of 8.3. Authenticated attackers can exploit this high-severity RCE vulnerability. Update to version 2.0.22 to mitigate risks.
June 28, 2026
CVE-2026-54815: Cargo Shipping Location for WooCommerce <= 5.6 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54815 reveals a high severity SQL injection vulnerability in the Cargo Shipping Location for WooCommerce plugin, affecting versions up to 5.6. Users should upgrade to version 5.7 to mitigate risks of data exposure.
June 28, 2026
CVE-2026-54808: WP Travel Gutenberg Blocks <= 3.9.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-54808 affects WP Travel Blocks plugin versions up to 3.9.4 with a CVSS score of 7.5. Unauthenticated SQL Injection allows attackers to extract sensitive data. Upgrade to version 3.9.5 to mitigate this risk.
June 28, 2026
CVE-2026-54823: Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-54823 affects the Widget Options plugin (up to v4.2.3) with a CVSS score of 8.8. It allows remote code execution for authenticated users. Update to v4.2.4 to mitigate this high-severity vulnerability.
June 27, 2026
CVE-2026-8095: Frontend File Manager Plugin <= 23.6 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-8095 affects the Nmedia User File Uploader plugin (up to version 23.6) with a CVSS score of 8.1. Authenticated attackers can delete arbitrary files, risking sensitive data exposure. Ensure timely patching to mitigate this risk.
June 27, 2026
CVE-2026-56012: Media Library Assistant <= 3.35 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-56012 affects the Media Library Assistant plugin for WordPress (up to version 3.35) with a medium severity (CVSS 6.5) SQL injection vulnerability. Update to version 3.36 to mitigate risks from authenticated attackers.
June 27, 2026
CVE-2026-56008: Avada (Fusion) Builder <= 3.15.4 Authenticated (Contributor+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-56008 affects the Fusion Builder plugin for WordPress (up to v3.15.4) with a high severity CVSS score of 8.8. Authenticated users can escalate privileges, highlighting the need for immediate patching.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.