AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-20
CVE-2024-13785: Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 – Unauthenticated Blind Arbitrary Shortcode Execution (arforms-form-builder)
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible…
2026-03-20
CVE-2025-14037: Invelity Products Feeds <= 1.2.6 – Cross-Site Request Forgery to Arbitrary File Deletion (invelity-products-feeds)
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests…
2026-03-20
CVE-2026-4373: JetFormBuilder <= 3.5.6.2 – Unauthenticated Arbitrary File Read via Media Field (jetformbuilder)
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient…
2026-03-20
CVE-2026-1093: WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute (wpfaqblock)
The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access…
2026-03-20
CVE-2026-1278: Mandatory Field <= 1.6.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields (mandatory-fields)
The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a…
2026-03-20
CVE-2026-1275: Multi Post Carousel by Category <= 1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute (multi-post-carousel)
The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the post_slides_shortcode function. This makes it possible for authenticated attackers, with…
2026-03-20
CVE-2026-1247: Survey <= 1.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (survey)
The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user…
2026-03-20
CVE-2026-0609: Logo Slider <= 4.9.0 – Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode (logo-slider-wp)
The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with…
2026-03-20
CVE-2026-2290: Post Affiliate Pro <= 1.28.0 – Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field (postaffiliatepro)
The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the application and read the returned response content. Successful exploitation was confirmed by receiving…
2026-03-20
CVE-2025-13910: WP-WebAuthn <= 1.3.4 – Unauthenticated Stored Cross-Site Scripting (wp-webauthn)
The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.