AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-17
CVE-2026-1655: EventPrime <= 4.2.8.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter (eventprime-event-calendar-management)
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a user-controlled event_id parameter and updating the corresponding event post without enforcing ownership or capability checks. This makes it possible for authenticated (Customer+)…
2026-02-17
CVE-2026-2419: WP-DownloadManager <= 1.69 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter (wp-downloadmanager)
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration parameter. This is due to insufficient validation of the download path setting, which allows directory traversal sequences to bypass the WP_CONTENT_DIR prefix check. This makes it possible for authenticated attackers, with Administrator-level access…
2026-02-17
CVE-2026-2112: Dam Spam <= 1.0.8 – Cross-Site Request Forgery to Arbitrary Pending Comment Deletion (dam-spam)
The Dam Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce verification on the pending comment deletion action in the cleanup page. This makes it possible for unauthenticated attackers to delete all pending comments via a forged request granted they…
2026-02-17
CVE-2026-1649: Community Events <= 1.5.7 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter (community-events)
The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ce_venue_name' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever…
2026-02-17
CVE-2026-2127: SiteOrigin Widgets Bundle <= 1.70.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution (so-widgets-bundle)
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to unauthorized arbitrary shortcode execution in all versions up to, and including, 1.70.4. This is due to a missing capability check on the `siteorigin_widget_preview_widget_action()` function which is registered via the `wp_ajax_so_widgets_preview` AJAX action. The function only verifies a nonce (`widgets_action`) but does not check user capabilities.…
2026-02-17
CVE-2025-13727: Video Share VOD <= 2.7.11 – Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values (video-share-vod)
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts…
2026-02-17
CVE-2026-2495: WPNakama <= 0.6.5 – Unauthenticated SQL Injection via 'order' REST API Parameter (wpnakama)
The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
2026-02-17
CVE-2026-2126: User Submitted Posts <= 20260113 – Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter (user-submitted-posts)
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in…
2026-02-17
CVE-2025-11185: Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (complianz-gdpr)
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-link shortcode in all versions up to, and including, 7.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary…
2026-02-17
CVE-2026-1942: Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification (blog2social)
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_draft AJAX action in all versions up to, and including, 8.7.4. The curationDraft() function only verifies current_user_can('read') without checking whether the user has edit_post permission for the target post.…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.