AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 26, 2026
CVE-2026-9242: RegistrationMagic <= 6.0.8.6 Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request PoC, Patch Analysis & Rule
CVE-2026-9242 affects the Custom Registration Form Builder plugin (up to version 6.0.8.6) with a CVSS score of 5.3. Unauthenticated attackers can bypass authentication. Update to version 6.0.8.7 to mitigate this risk.
June 26, 2026
CVE-2026-11597: Surbma | Infusionsoft Shortcode <= 2.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-11597 affects the Surbma Infusionsoft Shortcode plugin (up to 2.0.1) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability; update to version 2.0.2 to mitigate risks.
June 26, 2026
CVE-2026-11773: Masteriyo LMS <= 2.2.1 Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification PoC, Patch Analysis & Rule
CVE-2026-11773 affects the Masteriyo LMS plugin (up to v2.2.1) with a medium severity CVSS score of 4.3. Authenticated users can bypass authorization to modify course announcements. Upgrade to v2.3.0 to mitigate this risk.
June 26, 2026
CVE-2026-11987: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter PoC, Patch Analysis & Rule
CVE-2026-11987 affects Dokan Lite plugin versions up to 5.0.4, allowing authenticated users to access other vendors' unpublished products. Upgrade to 5.0.5 to mitigate this medium severity remote code execution risk.
June 26, 2026
CVE-2026-11783: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU PoC, Patch Analysis & Rule
CVE-2026-11783 affects Dokan Lite plugin versions up to 5.0.4, allowing stored XSS due to insufficient input sanitization. Update to 5.0.5 to mitigate risks from authenticated attackers injecting scripts into user sessions.
June 26, 2026
CVE-2026-12399: Gutenverse <= 3.8.0 Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter PoC, Patch Analysis & Rule
CVE-2026-12399 affects Gutenverse plugin versions 3.8.0 and below, with a CVSS score of 4.4. Authenticated users can exploit this cross-site scripting vulnerability. Update to version 3.8.1 to mitigate risks.
June 26, 2026
CVE-2026-13295: Page Builder by SiteOrigin <= 2.34.3 Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter PoC, Patch Analysis & Rule
CVE-2026-13295 affects the Siteorigin Panels plugin (up to v2.34.3) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Users should update to v2.34.4 to mitigate risks from potential script injections.
June 26, 2026
CVE-2026-12415: Invoice Generator <= 1.0.0 Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter PoC, Patch Analysis & Rule
CVE-2026-12415 reveals a critical vulnerability in the Invoice Creator plugin for WordPress (CVSS 9.8). Unauthenticated attackers can escalate privileges and take over accounts. Update to the latest version to mitigate this risk.
June 26, 2026
CVE-2026-12404: NEX-Forms <= 9.2.2 Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class PoC, Patch Analysis & Rule
CVE-2026-12404 affects Nex Forms Express WP Form Builder versions up to 9.2.2, allowing unauthenticated users to access sensitive data. Upgrade to version 9.2.3 to mitigate this medium severity vulnerability.
June 26, 2026
CVE-2026-13333: Groundhogg <= 4.5.5 Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter PoC, Patch Analysis & Rule
CVE-2026-13333 affects the Groundhogg plugin for WordPress (up to version 4.5.5) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit this SQL injection vulnerability, so update to version 4.5.6 to mitigate risks.
June 26, 2026
CVE-2026-13335: CodePeople Post Map for Google Maps <= 1.2.6 Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta PoC, Patch Analysis & Rule
CVE-2026-13335 affects the CodePeople Post Map plugin (up to version 1.2.6) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so update to version 1.2.7 to mitigate risks.
June 26, 2026
CVE-2026-13422: HD Quiz 2.2.0 2.2.1 Cross-Site Request Forgery via Multiple AJAX Handlers PoC, Patch Analysis & Rule
CVE-2026-13422 affects the HD Quiz plugin for WordPress (versions 2.2.0 to 2.2.1) with a CVSS score of 4.3. Patch to version 2.2.2 to mitigate Cross-Site Request Forgery risks that allow unauthorized changes to quizzes.
June 26, 2026
CVE-2026-13245: MaxButtons <= 9.8.5 Reflected Cross-Site Scripting via 'view' Parameter PoC, Patch Analysis & Rule
CVE-2026-13245 affects the MaxButtons plugin for WordPress (up to version 9.8.5) with a medium severity CVSS score of 6.1. Users should upgrade to version 9.8.6 to mitigate the reflected XSS vulnerability.
June 26, 2026
CVE-2026-13331: Groundhogg <= 4.5.5 Authenticated (Marketer+) SQL Injection via 'search' Parameter PoC, Patch Analysis & Rule
CVE-2026-13331 affects the Groundhogg plugin (up to v4.5.5) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit SQL injection via the 'search' parameter. Upgrade to v4.5.6 to mitigate this risk.
June 26, 2026
CVE-2026-54835: Five Star Restaurant Menu and Food Ordering <= 2.5.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-54835 affects the Food And Drink Menu plugin for WordPress (up to version 2.5.2) with a medium severity score of 5.3. Update to version 2.5.3 to mitigate unauthorized access risks.
June 26, 2026
CVE-2026-11356: Ivory Search <= 5.5.15 Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings PoC, Patch Analysis & Rule
CVE-2026-11356 affects the Ivory Search plugin for WordPress (up to version 5.5.15) with a medium severity (CVSS 4.4) stored XSS vulnerability. Update to version 5.5.16 to mitigate the risk of script injection by authenticated users.
June 26, 2026
CVE-2026-3462: Frisbii Pay <= 1.8.9 Missing Authorization to Authenticated (Subscriber+) Payment Token Modification PoC, Patch Analysis & Rule
CVE-2026-3462 affects the Reepay Checkout Gateway plugin (up to version 1.8.9) with a CVSS score of 6.5. Authenticated attackers can exploit this medium-severity vulnerability to modify WooCommerce data. Update to version 1.8.10.
June 26, 2026
CVE-2026-54188: JetEngine <= 3.8.10 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-54188 affects the Jet Engine plugin for WordPress (up to version 3.8.10) with a high severity CVSS score of 7.2. Unauthenticated attackers can exploit this stored XSS vulnerability, so patching is essential.
June 26, 2026
CVE-2025-13407: Gravity Forms <= 2.9.23.0 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-13407 affects the Gravity Forms plugin for WordPress (up to 2.9.23.0) with a CVSS score of 9.8. It allows unauthenticated file uploads, risking remote code execution. Update to the patched version to mitigate this critical...
June 25, 2026
CVE-2026-1869: User Registration & Membership <= 5.2.0 Missing Authorization to Unauthenticated Payment Bypass PoC, Patch Analysis & Rule
CVE-2026-1869 affects the User Registration plugin (up to version 5.2.0), allowing unauthenticated users to bypass payment processing. Update to version 5.2.1 to mitigate this medium severity vulnerability.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.