AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-01
CVE-2026-23978: Gyan Elements <= 2.2.1 – Authenticated (Contributor+) Local File Inclusion (gyan-elements)
The Gyan Elements plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to…
2026-01-31
CVE-2026-1369: Conditional CAPTCHA <= 4.0.0 – Unauthenticated Open Redirect (wp-conditional-captcha)
The Conditional CAPTCHA plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.0.0. This is due to insufficient validation on the redirect url supplied via a parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing…
2026-01-30
CVE-2026-25020: WP Sync for Notion <= 1.7.0 – Missing Authorization (wp-sync-for-notion)
The WP Sync for Notion – Notion to WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
2026-01-30
CVE-2026-25021: Mizan Demo Importer <= 0.1.3 – Missing Authorization (mizan-demo-importer)
The Mizan Demo Importer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 0.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
2026-01-30
CVE-2026-25391: WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 – Missing Authorization (ai-content-generation)
The WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3.07. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an…
2026-01-30
CVE-2025-14554: Sell BTC – Cryptocurrency Selling Calculator <= 1.5 – Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action (sell-btc-by-hayyatapps)
The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute…
2026-01-30
CVE-2026-25399: Serious Slider <= 1.2.7 – Missing Authorization (cryout-serious-slider)
The Serious Slider plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-01-30
CVE-2026-0683: SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 – Authenticated (Subscriber+) SQL Injection via Number Field Filter (supportcandy)
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing…
2026-01-30
CVE-2026-1431: Booking Calendar <= 10.14.13 – Missing Authorization to Unauthenticated Booking Details Exposure (booking)
The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.
2026-01-30
CVE-2026-25019: Atarim <= 4.3.1 – Missing Authorization (atarim-visual-collaboration)
The Visual Feedback, Review & AI Collaboration Tool For WordPress – Atarim plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.