AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-30
CVE-2026-1165: Popup Box <= 6.1.1 – Cross-Site Request Forgery to Popup Status Change (ays-popup-box)
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish…
2026-01-30
CVE-2025-15510: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 – Missing Authorization to Unauthenticated Sensitive Information Exposure (nex-forms-express-wp-form-builder)
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal…
2026-01-30
CVE-2025-15525: Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 – Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure (ajax-load-more)
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending,…
2026-01-29
CVE-2026-24368: The Grid < 2.8.0 – Missing Authorization (the-grid)
The The Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 2.8.0 (exclusive). This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-01-29
CVE-2025-68854: ID Arrays <= 2.1.2 – Reflected Cross-Site Scripting (id-arrays)
The ID Arrays plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such…
2026-01-29
CVE-2026-22341: Booked <= 3.0.0 – Authentication Bypass (booked)
The Booked - Appointment Booking for WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Custom-level access and above, to bypass authentication and access other user's accounts.
2026-01-29
CVE-2025-68051: Shiprocket <= 2.0.8 – Authenticated (Subscriber+) Insecure Direct Object Reference (shiprocket)
The Shiprocket plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
2026-01-29
CVE-2026-25407: Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode <= 4.6.4 – Missing Authorization (cookiebot)
The Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-01-29
CVE-2025-68005: Easy Hotel Booking <= 1.8.4 – Missing Authorization (easy-hotel)
The Easy Hotel Booking plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.8.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
2026-01-29
CVE-2026-25016: Nelio Popups <= 1.3.5 – Missing Authorization (nelio-popups)
The Nelio Popups plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.