AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-20
CVE-2026-3570: Smarter Analytics <= 2.0 – Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter (smarter-analytics)
The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post…
2026-03-20
CVE-2026-3478: Content Syndication Toolkit <= 1.3 – Unauthenticated Server-Side Request Forgery via 'url' Parameter (content-syndication-toolkit)
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly…
2026-03-20
CVE-2026-3546: e-shot <= 1.0.2 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action (e-shot-form-builder)
The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database…
2026-03-20
CVE-2026-32524: Photo Engine (Media Organizer & Lightroom) <= 6.4.9 – Authenticated (Author+) Arbitrary File Upload (wplr-sync)
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote…
2026-03-20
CVE-2026-3350: Image Alt Text Manager <= 1.8.2 – Authenticated (Author+) Stored Cross-Site Scripting via Post Title (alt-manager)
The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.2. This is due to insufficient input sanitization and output escaping when dynamically generating image alt and title attributes using a DOM parser. This makes it possible for authenticated attackers,…
2026-03-20
CVE-2026-4261: Expire Users <= 1.2.2 – Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields (expire-users)
The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that…
2026-03-20
CVE-2026-3584: Kali Forms <= 2.4.9 – Unauthenticated Remote Code Execution via form_process (kali-forms)
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated…
2026-03-20
CVE-2026-4083: Scoreboard for HTML5 Games Lite <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (scoreboard-for-html5-game-lite)
The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and including, 1.2. The shortcode function sfhg_shortcode() allows arbitrary HTML attributes to be added to the rendered element, with only a small blacklist of four attribute names (same_height_as, onload, onpageshow, onclick)…
2026-03-20
CVE-2026-3516: Contact List <= 3.0.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter (contact-list)
The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract tags from user…
2026-03-20
CVE-2026-3368: Injection Guard <= 1.2.9 – Unauthenticated Stored Cross-Site Scripting via Query Parameter Name (injection-guard)
The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missing output escaping in the ig_settings.php template where…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.