AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-04-03
CVE-2026-4896: WCFM – WooCommerce Frontend Manager <= 6.7.25 – Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation (wc-frontend-manager)
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including `wcfm_modify_order_status`, `delete_wcfm_article`, `delete_wcfm_product`, and the article management controller due to missing validation on user-supplied object IDs. This makes it…
2026-04-03
CVE-2025-15064: Ultimate Member <= 2.11.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets (ultimate-member)
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level…
2026-04-03
CVE-2026-2600: ElementsKit Elementor Addons and Templates <= 3.7.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget (elementskit-lite)
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and…
2026-04-03
CVE-2026-0552: Simple Shopping Cart <= 5.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode (wordpress-simple-paypal-shopping-cart)
The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts…
2026-04-03
CVE-2026-2437: WP Travel Engine – Travel and Tour Booking Plugin <= 6.7.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode (wp-travel-engine)
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor…
2026-04-03
CVE-2026-0738: Shortcodes Ultimate <= 7.4.8 – authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode (shortcodes-ultimate)
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access…
2026-04-03
CVE-2026-3445: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 – Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass (wp-user-avatar)
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible…
2026-04-03
CVE-2026-2826: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 – Missing Authorization to Authenticated (Contributor+) Media Upload (kadence-blocks)
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the `upload_files` capability in the `process_pattern` REST API endpoint. This makes it possible for authenticated attackers,…
2026-04-03
CVE-2026-3309: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 – Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields (wp-user-avatar)
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.11. This is due to the plugin allowing user-supplied billing field values from the checkout process to be interpolated into shortcode template…
2026-04-03
CVE-2025-14938: Listeo-Core – Directory Plugin by Purethemes <= 2.0.27 – Unauthenticated Arbitrary Media Upload (listeo-core)
The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeo_core_handle_dropped_media" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This makes it possible for unauthenticated attackers to upload arbitrary media to the site's…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.