AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-05
CVE-2026-1909: WaveSurfer-WP <= 2.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute (wavesurfer-wp)
The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's audio shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on the 'src' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages…
2026-02-05
CVE-2026-1279: Employee Directory <= 1.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute (employee-staff-directory)
The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages…
2026-02-05
CVE-2026-1808: Orange Confort+ accessibility toolbar for WordPress <= 0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (orange-confort-plus)
The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' parameter of the ocplus_button shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary…
2026-02-05
CVE-2026-1888: Docus <= 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (docus)
The Docus – YouTube Video Playlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'docusplaylist' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web…
2026-02-05
CVE-2025-10753: OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 – Missing Authorization (miniorange-login-with-eve-online-google-facebook)
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set…
2026-02-05
CVE-2026-1293: Yoast SEO <= 26.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute (wordpress-seo)
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schema` block attribute in all versions up to, and including, 26.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above,…
2026-02-05
CVE-2026-1785: Code Snippets <= 3.9.4 – Cross-Site Request Forgery to Cloud Snippet Download/Update Actions (code-snippets)
The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud…
2026-02-05
CVE-2026-1252: Events Listing Widget <= 1.3.4 – Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field (events-listing-widget)
The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will…
2026-02-05
CVE-2026-1499: WP Duplicate <= 1.1.8 – Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action (local-sync)
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to…
2026-02-04
CVE-2025-68022: Plugin BlueX for WooCommerce <= 3.1.4 – Missing Authorization (bluex-for-woocommerce)
The Plugin BlueX for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.