AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-06
CVE-2026-1675: Advanced Country Blocker <= 2.3.1 – Unauthenticated Authorization Bypass via Insecure Default Secret Key (advanced-country-blocker)
The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking…
2026-02-06
CVE-2026-1082: TITLE ANIMATOR <= 1.0 – Cross-Site Request Forgery to Settings Update (title-animator)
The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a…
2026-02-06
CVE-2026-1643: MP-Ukagaka <= 1.5.2 – Reflected Cross-Site Scripting (mp-ukagaka)
The MP-Ukagaka plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such…
2026-02-06
CVE-2026-1573: OMIGO <= 3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (omigo)
The OMIGO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `omigo_donate_button` shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages…
2026-02-06
CVE-2026-1634: Subitem AL Slider <= 1.0.0 – Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] (subitem-al-slider)
The Subitem AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a…
2026-02-06
CVE-2026-1611: Wikiloops Track Player <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (wikiloops-track-player)
The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts…
2026-02-06
CVE-2026-1570: Simple Bible Verse via Shortcode <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (simple-bible-verse-via-shortcode)
The Simple Bible Verse via Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `verse` shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary…
2026-02-06
CVE-2025-15477: The Bucketlister <= 0.1.5 – Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes (the-bucketlister)
The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and including, 0.1.5 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access…
2026-02-06
CVE-2026-0555: Premmerce <= 1.3.20 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint (premmerce)
The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the `state` parameter. This makes it possible for authenticated attackers, with subscriber level access and above,…
2026-02-06
CVE-2026-1608: Video Onclick <= 0.4.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (video-onclick)
The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up to, and including, 0.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.