AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-03-10
CVE-2026-27091: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 – Missing Authorization (uipress-lite)
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-03-10
CVE-2026-3903: Modular Connector <= 2.5.1 – Cross-Site Request Forgery via postConfirmOauth (modular-connector)
The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted…
2026-03-10
CVE-2026-1454: Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 – Unauthenticated Stored Cross-Site Scripting (lead-form-builder)
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive…
2026-03-10
CVE-2026-3178: Name Directory <= 1.32.1 – Unauthenticated Stored Cross-Site Scripting via 'name_directory_name' (name-directory)
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected…
2026-03-10
CVE-2026-2324: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 – Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting (latepoint)
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.7. This is due to missing or incorrect nonce validation on the reload_preview() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts…
2026-03-10
CVE-2026-2707: weForms <= 1.6.27 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API (weforms)
The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method…
2026-03-10
CVE-2025-13067: Royal Addons for Elementor <= 1.7.1049 – Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass (royal-elementor-addons)
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and…
2026-03-10
CVE-2026-3453: ProfilePress <= 4.16.11 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration (wp-user-avatar)
The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the change_plan_sub_id parameter in the process_checkout() function. The ppress_process_checkout AJAX handler accepts a user-controlled subscription ID intended for plan upgrades, loads the subscription record, and cancels/expires it…
2026-03-10
CVE-2026-1781: MC4WP: Mailchimp for WordPress <= 4.11.1 – Missing Authorization to Unauthenticated Arbitrary Subscription Deletion (mailchimp-for-wp)
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated…
2026-03-10
CVE-2026-2413: Ally – Web Accessibility & Usability <= 4.0.3 – Unauthenticated SQL Injection via URL Path (pojo-accessibility)
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.