AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-04-03
CVE-2026-3666: wpForo Forum <= 2.4.16 – Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (wpforo)
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4.16. This is due to a missing file name/path validation against path traversal sequences. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server by embedding…
2026-04-03
CVE-2026-5425: Widgets for Social Photo Feed <= 1.7.9 – Unauthenticated Stored Cross-Site Scripting via feed_data (social-photo-feed-widget)
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a…
2026-04-03
CVE-2026-2936: Visitor Traffic Real Time Statistics <= 8.4 – Unauthenticated Stored Cross-Site Scripting (visitors-traffic-real-time-statistics)
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin…
2026-04-03
CVE-2026-0626: WPFunnels <= 3.7.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode (wpfunnels)
The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated…
2026-04-02
CVE-2026-34890: MSTW League Manager <= 2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting (mstw-league-manager)
The MSTW League Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an…
2026-04-02
CVE-2026-4350: Perfmatters <= 2.5.9.1 – Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter (perfmatters)
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verification. The unsanitized filename is concatenated with the storage directory path and passed to `unlink()`.…
2026-04-01
CVE-2026-0686: Webmention <= 5.6.2 – Unauthenticated Blind Server-Side Request Forgery (webmention)
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information…
2026-04-01
CVE-2026-5032: W3 Total Cache <= 2.9.3 – Unauthenticated Security Token Exposure via User-Agent Header (w3-total-cache)
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY…
2026-04-01
CVE-2026-0688: Webmention <= 5.6.2 – Authenticated (Subscriber+) Server-Side Request Forgery (webmention)
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify…
2026-04-01
CVE-2026-4347: MW WP Form <= 5.1.0 – Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir (mw-wp-form)
The MW WP Form plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via the 'generate_user_filepath' function and the 'move_temp_file_to_upload_dir' function in all versions up to, and including, 5.1.0. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.