AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 11, 2026
CVE-2026-13457: InstaWP Connect <= 0.1.3.6 Unauthenticated Cryptographic Key Disclosure PoC, Patch Analysis & Rule
CVE-2026-13457 affects the Instawp Connect plugin (up to v0.1.3.6) with a CVSS score of 7.5. It allows remote code execution due to exposed migration keys. Update to v0.1.3.7 to mitigate risks.
August 11, 2026
CVE-2026-59536: CoCart – Headless REST API for WooCommerce <= 4.8.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59536 affects the Cart Rest Api For Woocommerce plugin (up to v4.8.4) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium severity vulnerability. Update to v4.9.0 to mitigate risks.
August 11, 2026
CVE-2026-15426: AcyMailing <= 10.11.1 Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update PoC, Patch Analysis & Rule
CVE-2026-15426 affects AcyMailing versions up to 10.11.1, allowing authenticated attackers to bypass authorization and capture password-reset emails. Upgrade to version 11.0.0 to mitigate this high-severity vulnerability.
August 11, 2026
CVE-2026-61985: Car Rental Manager – Online Vehicle Booking System <= 1.3.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-61985 affects the Car Rental Manager plugin for WordPress (up to v1.3.7) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit a missing capability check, so patching is essential.
August 11, 2026
CVE-2026-65514: Appointment Hour Booking – Booking Calendar <= 1.5.86 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65514 affects the Appointment Hour Booking plugin for WordPress, versions 1.5.86 and earlier, with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to version 1.5.87 to mitigate the risk of script injection.
August 11, 2026
CVE-2026-65536: افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65536 affects the Persian Woocommerce Shipping plugin (up to version 4.4.5) with a medium severity CVSS score of 4.3. Ensure to patch to prevent CSRF attacks that could allow unauthorized actions.
August 11, 2026
CVE-2026-65499: PeproDev Ultimate Invoice <= 2.2.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65499 affects the Pepro Ultimate Invoice plugin (up to version 2.2.6), allowing unauthorized access due to a missing capability check. Users should update to the patched version to mitigate this medium severity vulnerability.
August 11, 2026
CVE-2026-65524: Avada Custom Branding <= 1.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65524 affects the Fusion White Label Branding plugin for WordPress, version 1.2 and earlier. This medium-severity vulnerability allows authenticated attackers to perform unauthorized actions; patching is recommended.
August 11, 2026
CVE-2026-65540: Popup for CF7 with Sweet Alert <= 1.6.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65540 affects the Cf7 Sweet Alert Popup plugin for WordPress (up to v1.6.5) with a medium severity (CVSS 4.3). Ensure proper nonce validation to mitigate CSRF risks and update to the patched version.
August 11, 2026
CVE-2026-59530: Payment Plugins for Stripe WooCommerce <= 4.0.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59530 affects the Woo Stripe Payment plugin (up to v4.0.7) with a CVSS score of 5.3. Unauthenticated attackers can exploit this remote code execution vulnerability. Update to v4.0.8 to mitigate risks.
August 11, 2026
CVE-2026-65510: PeproDev Ultimate Invoice <= 2.2.6 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65510 affects the Pepro Ultimate Invoice plugin for WordPress (up to version 2.2.6) with a high severity CVSS score of 7.2 due to stored XSS. Users should update to the patched version to mitigate risks.
August 11, 2026
CVE-2026-27372: PeproDev Ultimate Invoice <= 2.2.6 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-27372 affects the Pepro Ultimate Invoice plugin for WordPress (up to version 2.2.6), exposing sensitive data to unauthenticated attackers. No patch is available, highlighting the need for immediate mitigation.
August 11, 2026
CVE-2026-65516: PeproDev Ultimate Invoice <= 2.2.6 Unauthenticated Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65516 affects the Pepro Ultimate Invoice plugin (up to 2.2.6) with a high severity CVSS of 7.2. Unauthenticated SSRF vulnerabilities allow attackers to make unauthorized web requests. Patching is essential.
August 11, 2026
CVE-2026-65494: Dokan Pro <= 5.0.2 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65494 affects Dokan Pro versions up to 5.0.2 with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated users can exploit this to extract sensitive data; ensure you update to the patched version.
August 11, 2026
CVE-2026-65492: Dokan Pro <= 5.0.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65492 affects Dokan Pro plugin versions up to 5.0.0, exposing users to high severity stored cross-site scripting risks. Ensure you update to the patched version to mitigate potential attacks.
August 11, 2026
CVE-2025-49985: Auto Upload Images <= 3.3.2 Authenticated (Contributor+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-49985 affects the Auto Upload Images plugin for WordPress (up to 3.3.2) with a CVSS score of 6.4. Authenticated users can exploit this medium-severity SSRF vulnerability, impacting internal service confidentiality. Patching is...
August 10, 2026
CVE-2026-16974: Kirki Freeform Page Builder, Website Builder & Customizer <= 6.2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode PoC, Patch Analysis & Rule
CVE-2026-16974 affects the Kirki plugin for WordPress (up to 6.2.0) with a medium severity CVSS of 6.4. Authenticated users can exploit a stored XSS vulnerability; update to version 6.2.1 to mitigate risks.
August 10, 2026
CVE-2026-59537: Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59537 affects the Sender Net Automated Emails plugin for WordPress, versions up to 2.10.22. This medium severity SQL injection vulnerability allows authenticated attackers to extract sensitive data. Patch immediately.
August 10, 2026
CVE-2026-65533: Smart SEO Tool – SEO优化插件 <= 4.1.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65533 affects the Smart SEO Tool plugin for WordPress (up to version 4.1.2) with a medium severity CVSS score of 6.4. Users should implement input sanitization measures as no patch is currently available.
August 10, 2026
CVE-2026-65519: Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.29 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65519 affects the GT3 Photo Video Gallery plugin (up to version 2.7.7.29) with a medium severity XSS vulnerability (CVSS 6.4). Update to version 2.7.7.30 to mitigate risks from authenticated attackers.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.