AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-20
CVE-2026-3474: EmailKit <= 1.6.3 – Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter (emailkit)
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path…
2026-03-20
CVE-2026-2941: Linksy Search and Replace <= 1.0.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details (linksy-search-and-replace)
The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp_capabilities…
2026-03-20
CVE-2026-4087: Pre* Party Resource Hints <= 1.8.20 – Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter (pre-party-browser-hints)
The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all versions up to, and including, 1.8.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible…
2026-03-20
CVE-2026-3506: WP-Chatbot for Messenger <= 4.9 – Missing Authorization to Unauthenticated Chatbot Configuration Takeover (wp-chatbot)
The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the site's MobileMonkey API token and company ID…
2026-03-20
CVE-2026-3003: Vagaro Booking Widget <= 0.3 – Unauthenticated Stored Cross-Site Scripting via 'vagaro_code' (vagaro-booking-widget)
The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an…
2026-03-20
CVE-2026-2468: Quentn WP <= 1.2.12 – Unauthenticated SQL Injection via 'qntn_wp_access' Cookie (quentn-wp)
The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the `get_user_access()` method. This makes it possible for unauthenticated attackers…
2026-03-20
CVE-2026-4022: Show Posts list <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (show-posts-shortcodes)
The Show Posts list – Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute in the 'swiftpost-list' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with…
2026-03-20
CVE-2026-4086: WP Random Button <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute (wp-random-button)
The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the random_button_html() function directly concatenates the 'cat'…
2026-03-20
CVE-2026-4084: fyyd podcast shortcodes <= 0.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (fyyd-podcast-shortcodes)
The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in all versions up to, and including, 0.3.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'color', 'podcast_id', and 'podcast_slug'. These attributes are directly concatenated into inline…
2026-03-20
CVE-2026-4067: Ad Short <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute (ad-short)
The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1. This is due to insufficient input sanitization and output escaping on the 'client' shortcode attribute. The ad_func() shortcode handler at line 71 accepts a 'client' attribute via shortcode_atts() and…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.