AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 13, 2026
CVE-2026-16810: Bit Form <= 3.2.0 Authenticated (Administrator+) SQL Injection via 'filterText' Parameter PoC, Patch Analysis & Rule
CVE-2026-16810 affects the Bit Form plugin (up to v3.2.0) with a medium severity SQL injection vulnerability (CVSS 6.5). Update to v3.2.1 to mitigate risks of data exposure by authenticated attackers.
August 13, 2026
CVE-2026-18109: W3 Total Cache <= 2.10.3 Unauthenticated Stored Cross-Site Scripting via Comment Author Name PoC, Patch Analysis & Rule
CVE-2026-18109 affects W3 Total Cache plugin versions up to 2.10.3 with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows unauthenticated attackers to inject scripts. Upgrade to 2.10.4 to mitigate.
August 13, 2026
CVE-2026-73401: InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-73401 affects the InstaWP Connect plugin (up to v0.1.3.7) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v0.1.3.8 to mitigate risks associated with unauthorized migration actions.
August 13, 2026
CVE-2026-13612: KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 Authenticated (Custom role+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-13612 affects the Kivicare Clinic Management System plugin (up to version 4.5.2) with a CVSS score of 4.3. Authenticated attackers can access sensitive data; patching is essential to mitigate this risk.
August 13, 2026
CVE-2026-12976: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-12976 affects the LearnPress plugin (up to version 4.4.4) with a CVSS score of 4.3. Authenticated attackers can exploit this vulnerability to access sensitive data. Users should update to the patched version to mitigate risks.
August 13, 2026
CVE-2026-13168: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 Authenticated (Contributor+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-13168 affects the Wp Event Solution plugin (up to version 4.1.20) with a medium severity (CVSS 4.3). Authenticated attackers can exploit this vulnerability to access sensitive user data. Users should update to the patched version.
August 13, 2026
CVE-2026-73349: GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-73349 affects the GiveWP Donation Plugin (up to version 4.16.6) allowing unauthorized access due to a missing capability check. Users should patch to the latest version to mitigate this medium severity vulnerability.
August 13, 2026
CVE-2025-10308: Astro Booking Engine <= 1.4.0 Cross-Site Request Forgery to Settings Reset PoC, Patch Analysis & Rule
CVE-2025-10308 affects the Astro Booking Engine plugin (up to v1.4.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Update to v1.4.1 to mitigate the risk of unauthorized settings deletion.
August 13, 2026
CVE-2026-13177: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 Authenticated (Contributor+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-13177 affects the Wp Event Solution plugin (up to version 4.1.20) with a medium severity CVSS score of 4.3, allowing authenticated attackers to access sensitive data. Ensure you update to the patched version to mitigate this risk.
August 13, 2026
CVE-2026-66660: Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-66660 affects the Contact Form 7 Paypal Add On (up to version 2.5.1) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
August 13, 2026
CVE-2026-73353: Revolut Gateway for WooCommerce < 4.22.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-73353 affects the Revolut Gateway for WooCommerce plugin, allowing unauthorized access due to a missing capability check. Users should update to version 4.22.10 to mitigate this medium severity vulnerability.
August 13, 2026
CVE-2026-73346: Mailchimp for WooCommerce < 6.2 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-73346 affects the Mailchimp for WooCommerce plugin (up to version 6.2) with a medium severity SQL injection vulnerability. Admins should patch to the latest version to prevent potential data exposure.
August 13, 2026
CVE-2026-73357: GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 Authenticated (Donor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-73357 affects the GiveWP Donation Plugin for WordPress, allowing authenticated attackers to exploit a Stored XSS vulnerability. Users should update to version 4.16.6 to mitigate this medium severity risk with a CVSS score of 6.4.
August 13, 2026
CVE-2026-73344: WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-73344 affects the WP Data Access plugin (up to version 5.5.79) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so update to version 5.5.80 to mitigate risks.
August 13, 2026
CVE-2026-27999: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27999 affects the Tourfic plugin (up to version 2.23.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Patching is essential to mitigate this risk.
August 13, 2026
CVE-2026-27537: Smart Popup by Supsystic <= 1.11.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27537 affects the Popup By Supsystic plugin (v1.11.2 and below) with a high severity score of 7.2 due to stored XSS. Update to v1.12.0 to mitigate the risk of script injection attacks.
August 12, 2026
CVE-2026-3639: PPWP – Password Protect Pages <= 1.9.21 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-3639 affects the Password Protect Page plugin (up to v1.9.21) with a CVSS score of 6.4. Authenticated users can exploit stored XSS vulnerabilities, making it crucial to update to v1.9.22 for protection.
August 12, 2026
CVE-2026-18146: Fluent Forms <= 6.2.11 Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values PoC, Patch Analysis & Rule
CVE-2026-18146 affects Fluent Forms versions up to 6.2.11 with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts via notification settings. Upgrade to 6.2.12 to mitigate risks.
August 12, 2026
CVE-2026-3835: Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 Unauthenticated Protected File Access PoC, Patch Analysis & Rule
CVE-2026-3835 affects the Prevent Direct Access plugin (up to v2.8.8.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized file access. Upgrade to v2.8.8.9 to mitigate this risk.
August 12, 2026
CVE-2026-65493: Dokan Pro <= 5.0.2 Authenticated (Subscriber+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-65493 affects Dokan Pro versions up to 5.0.2, allowing authenticated attackers to exploit a PHP Object Injection vulnerability. With a CVSS score of 7.5, patching is essential to prevent potential file deletion or code execution.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.