AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-17
CVE-2025-11737: VK All in One Expansion Unit <= 9.112.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title (vk-all-in-one-expansion-unit)
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_sns_title' parameter in all versions up to, and including, 9.112.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages…
2026-02-17
CVE-2026-1639: Taskbuilder <= 5.0.2 – Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters (taskbuilder)
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…
2026-02-17
CVE-2026-2023: WP Plugin Info Card <= 6.2.0 – Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation (wp-plugin-info-card)
The WP Plugin Info Card plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0. This is due to missing nonce validation in the ajax_save_custom_plugin() function, which is disabled by prefixing the check with 'false &&'. This makes it possible for unauthenticated attackers to create or modify custom…
2026-02-17
CVE-2026-1906: PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 – Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification (woocommerce-pdf-invoices-packing-slips)
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI…
2026-02-17
CVE-2026-1072: Keybase.io Verification <= 1.4.5 – Cross-Site Request Forgery to Settings Update (wp-keybase-verification)
The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. This is due to missing nonce validation when updating plugin settings. This makes it possible for unauthenticated attackers to update the Keybase verification text via a forged request granted they can trick a site administrator…
2026-02-17
CVE-2026-1640: Taskbuilder <= 5.0.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation (taskbuilder)
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.2. This is due to missing authorization checks on the project and task comment submission functions (AJAX actions: wppm_submit_proj_comment and wppm_submit_task_comment). This makes it possible for authenticated attackers, with subscriber-level access…
2026-02-17
CVE-2026-1666: Download Manager <= 3.3.46 – Reflected Cross-Site Scripting via 'redirect_to' Parameter (download-manager)
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirect_to' GET parameter in the login form shortcode. This makes it possible for unauthenticated attackers to inject arbitrary web…
2026-02-17
CVE-2026-1857: Gutenberg Blocks with AI by Kadence WP <= 3.6.1 – Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter (kadence-blocks)
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.6.1. This is due to insufficient validation of the `endpoint` parameter in the `get_items()` function of the GetResponse REST API handler. The endpoint's permission check only requires `edit_posts` capability (Contributor role)…
2026-02-17
CVE-2026-2633: Gutenberg Blocks with AI by Kadence WP <= 3.6.1 – Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload (kadence-blocks)
The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.1. This is due to a missing capability check in the `process_image_data_ajax_callback()` function which handles the `kadence_import_process_image_data` AJAX action. The function's authorization check via `verify_ajax_call()` only validates `edit_posts` capability but fails to…
2026-02-17
CVE-2026-2019: Cart All In One For WooCommerce <= 1.1.21 – Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting (woo-cart-all-in-one)
The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above,…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.