AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-04
CVE-2025-67984: NPS computy <= 2.8.2 – Unauthenticated Stored Cross-Site Scripting (nps-computy)
The NPS computy plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-02-04
CVE-2025-69324: NEX-Forms <= 9.1.7 – Unauthenticated Stored Cross-Site Scripting (nex-forms-express-wp-form-builder)
The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 9.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-02-04
CVE-2026-0867: Essential Widgets <= 3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (essential-widgets)
The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-menu shortcodes in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to…
2026-02-04
CVE-2025-68037: Export Media URLs <= 2.2 – Reflected Cross-Site Scripting (export-media-urls)
The Export Media URLs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
2026-02-04
CVE-2026-1246: ShortPixel Image Optimizer <= 6.4.2 – Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter (shortpixel-image-optimiser)
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the…
2026-02-04
CVE-2025-13192: Popup builder with Gamification <= 2.2.0 – Unauthenticated SQL Injection via Multiple REST API Endpoints (popup-builder-block)
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
2026-02-04
CVE-2025-14079: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 – Missing Authorization to Authenticated (Subscriber+) Settings Update (elex-helpdesk-customer-support-ticket-system)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level…
2026-02-04
CVE-2026-1271: ProfileGrid <= 5.9.7.2 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification (profilegrid-user-profiles-groups-and-communities)
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it…
2026-02-04
CVE-2026-1654: Peter’s Date Countdown <= 2.0.0 – Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] (peters-date-countdown)
The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a…
2026-02-04
CVE-2025-13416: ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension (profilegrid-user-profiles-groups-and-communities)
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all versions up to, and including, 5.9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to suspend arbitrary users from groups, including administrators,…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.