AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 12, 2026
CVE-2026-59535: Thrive Themes – Product Manager <= 10.9.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59535 affects the Thrive Product Manager plugin for WordPress (up to 10.9.2) with a medium severity (CVSS 5.3). Ensure you patch to mitigate unauthorized access risks.
August 12, 2026
CVE-2026-65525: Civi Framework <= 2.2.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65525 affects Civi Framework plugin versions up to 2.2.0, allowing unauthorized access due to a missing capability check. Users should patch to mitigate this medium severity vulnerability with a CVSS score of 5.3.
August 12, 2026
CVE-2026-65534: Custom links in Elementor Image Carousel <= 1.1.1 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65534 affects the Custom Links In Elementor Image Carousel plugin (up to v1.1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so patching is essential.
August 12, 2026
CVE-2026-59534: Post My CF7 Form <= 6.2.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59534 affects the Post My Contact Form 7 plugin (up to version 6.2.0) with a CVSS score of 5.3. This medium-severity vulnerability allows unauthorized access; update to version 7.0.0 to mitigate risks.
August 12, 2026
CVE-2026-59546: WP Ghost (Hide My WP Ghost) – Security & Firewall <= 7.0.06 Two-Factor Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-59546 affects Hide My Wp plugin versions up to 7.0.06, allowing authenticated users to bypass Two-Factor Authentication. Update to version 7.0.07 to mitigate this medium severity vulnerability.
August 12, 2026
CVE-2026-65530: TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65530 affects the TemplateSpare plugin (versions up to 4.2.2) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this flaw for unauthorized actions, highlighting the need for immediate patching.
August 12, 2026
CVE-2026-65535: TinyMCE Templates <= 4.8.1 Authenticated (Contributor+) Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2026-65535 affects TinyMCE Templates versions up to 4.8.1, allowing authenticated attackers to expose sensitive data. Users should upgrade to the patched version to mitigate this medium-severity vulnerability.
August 12, 2026
CVE-2026-59531: Falcon – WordPress Optimizations & Tweaks <= 2.10.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59531 affects the Falcon plugin for WordPress (up to version 2.10.0) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so update to version 2.10.1 to mitigate risks.
August 12, 2026
CVE-2026-59533: Relevanssi Light <= 1.2.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59533 affects the Relevanssi Light plugin for WordPress (up to version 1.2.2) with a high severity CVSS score of 7.5. Unauthenticated SQL injection can expose sensitive data; update to version 1.2.3 to mitigate.
August 12, 2026
CVE-2026-59552: 3D Flipbook PDF Viewer & Embedder <= 1.4.2 Unauthenticated Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-59552 affects the Pdf Embed Viewer plugin (up to v1.4.2) with a high severity CVSS score of 7.2. Unauthenticated SSRF vulnerabilities can be mitigated by upgrading to version 1.4.4.
August 12, 2026
CVE-2026-65453: Ebook Store <= 6.19 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65453 affects the Ebook Store plugin for WordPress (versions up to 6.19) with a medium severity CVSS score of 5.3. Ensure you update to the patched version to mitigate unauthorized access risks.
August 12, 2026
CVE-2026-65538: Machete <= 5.2 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65538 affects the Machete plugin for WordPress (up to version 5.2) with a medium severity (CVSS 6.4) due to stored XSS. Update to version 5.3 to mitigate risks from potential script injections.
August 12, 2026
CVE-2026-59548: Byteflows Travel & Hotel Booking <= 1.0.0 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-59548 affects the Byteflows Travel Hotel Booking plugin (up to 1.0.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated data exposure. Update to version 1.0.1 to mitigate risks.
August 12, 2026
CVE-2026-65478: ListingPro Plugin <= 2.9.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65478 affects the ListingPro Plugin for WordPress (up to version 2.9.10) with a medium severity (CVSS 4.3). Ensure to update to the patched version to prevent unauthorized actions by authenticated users.
August 12, 2026
CVE-2026-65452: Ebook Store <= 6.19 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65452 affects the Ebook Store plugin for WordPress (versions 6.19 and earlier) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version to mitigate risks.
August 11, 2026
CVE-2026-15606: Frontend Admin by DynamiApps <= 3.29.9 Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token PoC, Patch Analysis & Rule
CVE-2026-15606 affects the ACF Frontend Form Element plugin (up to version 3.29.9) with a CVSS score of 8.8. It allows authenticated attackers to bypass authorization and reset any user's password. Update to version 3.29.10 to mitigate.
August 11, 2026
CVE-2026-18961: Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 Unauthenticated Authentication Bypass via Spotify OAuth Callback PoC, Patch Analysis & Rule
CVE-2026-18961 affects the Ventraconnect Social Login plugin (up to v1.4.3) with a high severity (CVSS 8.1) authentication bypass. Update to v1.4.4 to prevent unauthorized access to WordPress accounts.
August 11, 2026
CVE-2026-19091: GeoDirectory <= 2.8.169 Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision PoC, Patch Analysis & Rule
CVE-2026-19091 affects the GeoDirectory plugin (up to version 2.8.169), posing a high severity risk (CVSS 8.1) due to arbitrary file deletion. Update to version 2.8.170 to mitigate potential remote code execution risks.
August 11, 2026
CVE-2026-16230: Formidable Digital Signatures <= 3.0.6 Unauthenticated Arbitrary File Deletion via Signature Field PoC, Patch Analysis & Rule
CVE-2026-16230 affects the Formidable Signature plugin for WordPress (up to version 3.0.6) with a critical CVSS score of 9.8. Unauthenticated attackers can delete files on the server, highlighting the need for immediate patching.
August 11, 2026
CVE-2026-65527: LIQUID SPEECH BALLOON <= 1.2.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65527 affects the Liquid Speech Balloon plugin for WordPress, versions 1.2.5 and earlier, with a medium severity CVSS score of 6.4. Users should upgrade to version 1.2.6 to mitigate stored XSS risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.