AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-04-21
CVE-2026-5767: SlideShowPro SC <= 1.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute (slideshowpro-shortcode)
The SlideShowPro SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `slideShowProSC` shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in…
2026-04-21
CVE-2026-5820: Zypento Blocks <= 1.0.6 – Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block (zypento-blocks)
The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This is due to the front-end TOC rendering script reading heading text via `innerText` and inserting it into the page using `innerHTML` without proper sanitization. This makes it possible…
2026-04-21
CVE-2026-6236: Posts map <= 0.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (posts-map)
The Posts map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute in all versions up to, and including, 0.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in…
2026-04-21
CVE-2026-6041: Buzz Comments <= 0.9.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Buzz Avatar' Setting (buzz-comments)
The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in…
2026-04-21
CVE-2026-6396: Fast & Fancy Filter – 3F <= 1.2.2 – Cross-Site Request Forgery to Settings Modification via fff_save_settins AJAX Action (fast-fancy-filter-3f)
The Fast & Fancy Filter – 3F plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce verification in the saveFields() function, which handles the fff_save_settins AJAX action. This makes it possible for unauthenticated attackers to modify plugin filter settings, update arbitrary options,…
2026-04-21
CVE-2026-4074: Quran Live Multilanguage <= 1.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (quran-live)
The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran_live_render() function of quran-live.php receives shortcode attributes and passes them directly through…
2026-04-21
CVE-2026-4280: Breaking News WP <= 1.3 – Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read (breaking-news-wp)
The Breaking News WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3. This is due to the brnwp_ajax_form AJAX endpoint lacking both authorization checks and CSRF verification, combined with insufficient path validation when the brnwp_theme option value is passed directly to an include() statement in the…
2026-04-21
CVE-2026-4142: Sentence To SEO (keywords, description and tags) <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' Field (sentence-to-seo)
The Sentence To SEO (keywords, description and tags) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Permanent keywords' field in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin reads user input via filter_input_array(INPUT_POST) which applies no HTML sanitization (FILTER_DEFAULT), stores it…
2026-04-21
CVE-2026-4140: Ni WooCommerce Order Export <= 3.1.6 – Cross-Site Request Forgery to Settings Update via ni_order_export_action AJAX Action (ni-woocommerce-order-export)
The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the ni_order_export_action() AJAX handler function. The handler processes settings updates when the 'page' parameter is set to 'nioe-order-settings', delegating to Ni_Order_Setting::page_ajax() which calls update_option('ni_order_export_option', $_REQUEST)…
2026-04-21
CVE-2026-4138: DX Unanswered Comments <= 1.7 – Cross-Site Request Forgery via Settings Update (dx-unanswered-comments)
The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation on the plugin's settings form in the dxuc-unanswered-comments-admin-page.php file. This makes it possible for unauthenticated attackers to modify plugin settings (dxuc_authors_list and dxuc_comment_count) via a forged request…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.