AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-12
CVE-2026-2890: Formidable Forms <= 6.28 – Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse (formidable)
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and…
2026-03-12
CVE-2026-2987: Simple Ajax Chat <= 20260217 – Unauthenticated Stored Cross-Site Scripting via 'c' (simple-ajax-chat)
The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected…
2026-03-12
CVE-2026-2888: Formidable Forms <= 6.28 – Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter (formidable)
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in…
2026-03-12
CVE-2026-2879: GetGenie <= 4.3.2 – Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion (getgenie)
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the `id` parameter in the `create()` method of the `GetGenieChat` REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists,…
2026-03-12
CVE-2026-3986: Calculated Fields Form <= 5.4.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings (calculated-fields-form)
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for…
2026-03-12
CVE-2026-2257: GetGenie <= 4.3.2 – Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API (getgenie)
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a…
2026-03-12
CVE-2026-4063: Social Icons Widget & Block <= 4.5.8 – Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation (social-icons-widget-by-wpzoom)
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without…
2026-03-11
CVE-2026-3226: LearnPress <= 4.3.2.8 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering (learnpress)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The…
2026-03-11
CVE-2026-3657: My Sticky Bar <= 2.8.6 – Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action (mystickymenu)
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys…
2026-03-10
CVE-2026-2569: Dear Flipbook <= 2.4.20 – Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels (3d-flipbook-dflip-lite)
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PDF page labels in all versions up to, and including, 2.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.