AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-10
CVE-2026-1804: WDES Responsive Popup <= 1.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute (wdes-responsive-popup)
The WDES Responsive Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdes-popup-title' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts…
2026-02-10
CVE-2026-1748: Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 – Missing Authorization to Authenticated (Subscriber+) Information Exposure (kirilkirkov-pdf-invoice-manager)
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve invoice clients, invoice items, and…
2026-02-10
CVE-2026-1853: BuddyHolis ListSearch <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute (listsearch)
The BuddyHolis ListSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listsearch' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in…
2026-02-10
CVE-2025-15096: Videospirecore Theme Plugin <= 1.0.6 – Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover (videospirecore)
The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to…
2026-02-10
CVE-2026-2295: WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 – Unauthenticated Protected Post Exposure via ajax_post_grid_load_more (wpzoom-elementor-addons)
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts…
2026-02-09
CVE-2025-69325: Primer MyData for Woocommerce <= 4.2.8 – Unauthenticated Path Traversal (primer-mydata)
The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to perform actions on files outside of the originally intended directory.
2026-02-09
CVE-2025-69379: Upload Files Anywhere <= 2.8 – Unauthenticated Arbitrary File Deletion (wp-upload-files-anywhere)
The WordPress Upload Files Anywhere plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 2.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the…
2026-02-09
CVE-2025-69380: Upload Files Anywhere <= 2.8 – Unauthenticated Arbitrary File Download (wp-upload-files-anywhere)
The WordPress Upload Files Anywhere plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
2026-02-09
CVE-2025-69381: WooCommerce Bulk Product Editor <= 3.0 – Missing Authorization (woocommerce-quick-product-editor)
The WooCommerce Bulk Product Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-02-09
CVE-2025-69383: shop <= 2.6.1 – Unauthenticated Local File Inclusion (wpshop)
The shop plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.6.1. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data,…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.