AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-04-21
CVE-2026-2719: Private WP suite <= 0.4.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting (private-wp-suite)
The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that…
2026-04-21
CVE-2026-3362: Short Comment Filter <= 2.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting (short-comment-filter)
The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The…
2026-04-21
CVE-2026-1395: Gutentools <= 1.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes (gutentools)
The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block_id attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduces dangerous characters. This makes it possible for authenticated attackers, with Contributor-level…
2026-04-21
CVE-2026-1845: Real Estate Pro <= 1.0.9 – Authenticated (Admin+) Stored Cross-Site Scripting via Settings (re-pro)
The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever…
2026-04-21
CVE-2026-1930: Emailchef <= 3.5.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (emailchef)
The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's settings via the 'emailchef_disconnect' AJAX action.
2026-04-21
CVE-2026-1913: Gallagher Website Design <= 2.6.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute (gallagher-website-design)
The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the 'prefix' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts…
2026-04-21
CVE-2026-4088: Switch CTA Box <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (switch-cta-box)
The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. The shortcode reads post meta from a user-specified post…
2026-04-21
CVE-2026-4085: Easy Social Photos Gallery <= 3.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute (my-instagram-feed)
The Easy Social Photos Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper_class' shortcode attribute of the 'my-instagram-feed' shortcode in all versions up to, and including, 3.1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. Specifically, the plugin uses sanitize_text_field() instead of esc_attr() when outputting…
2026-04-21
CVE-2026-4076: Slider Bootstrap Carousel <= 1.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (slider-bootstrap-carousel)
The Slider Bootstrap Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'category' and 'template' shortcode attributes in all versions up to and including 1.0.7. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The plugin uses extract() on shortcode_atts() to parse attributes, then directly outputs the…
2026-04-21
CVE-2026-4353: CI HUB Connector <= 1.2.106 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (ci-hub-connector)
The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the `cihub_metadata` shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.