AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 16, 2026
CVE-2025-49931: JetSearch <= 3.5.10 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-49931 affects the Jet Search plugin for WordPress (up to version 3.5.10) with a high severity CVSS score of 7.5. Unauthenticated SQL injection can expose sensitive data; users should update to the patched version.
April 10, 2026
CVE-2025-6986: FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 Authenticated (Author+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-6986 affects the FileBird plugin (up to version 6.4.8) with a medium severity SQL injection vulnerability (CVSS 6.5). Update to version 6.4.9 to mitigate risks from authenticated attackers exploiting this flaw.
April 6, 2026
CVE-2026-0626: WPFunnels <= 3.7.9 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0626 affects the WPFunnels plugin (up to version 3.7.9) with a CVSS score of 6.4. This medium-severity XSS vulnerability allows authenticated attackers to inject scripts. Update to the patched version to mitigate risks.
April 6, 2026
CVE-2026-2936: Visitor Traffic Real Time Statistics <= 8.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-2936 affects the Visitors Traffic Real Time Statistics plugin for WordPress, with a CVSS score of 7.2. Upgrade to version 8.5 to mitigate the high-severity stored XSS vulnerability.
April 6, 2026
CVE-2026-5425: Widgets for Social Photo Feed <= 1.7.9 Unauthenticated Stored Cross-Site Scripting via feed_data PoC, Patch Analysis & Rule
CVE-2026-5425 affects the Social Photo Feed Widget plugin (up to v1.7.9) with a CVSS score of 7.2. Unauthenticated attackers can exploit a stored XSS flaw, making it crucial to update to v1.8 for security.
April 6, 2026
CVE-2026-3666: wpForo Forum <= 2.4.16 Authenticated (Subscriber+) Arbitrary File Deletion via Post Body PoC, Patch Analysis & Rule
CVE-2026-3666 affects the wpForo plugin (up to v2.4.16) with a CVSS score of 8.8. This high-severity file upload vulnerability allows authenticated users to delete arbitrary server files. Update to v2.4.17 to mitigate risks.
April 6, 2026
CVE-2025-14938: Listeo-Core Directory Plugin by Purethemes <= 2.0.27 Unauthenticated Arbitrary Media Upload PoC, Patch Analysis & Rule
CVE-2025-14938 affects the Listeo Core plugin (versions
April 6, 2026
CVE-2026-3309: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields PoC, Patch Analysis & Rule
CVE-2026-3309 affects the Wp User Avatar plugin (versions
April 6, 2026
CVE-2026-2826: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 Missing Authorization to Authenticated (Contributor+) Media Upload PoC, Patch Analysis & Rule
CVE-2026-2826 affects the Kadence Blocks plugin (up to v3.6.3) with a medium severity CVSS score of 4.3. An authorization bypass allows contributors to upload images without proper permissions. Update to v3.6.4 to mitigate this risk.
April 6, 2026
CVE-2026-3445: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass PoC, Patch Analysis & Rule
CVE-2026-3445 affects the ProfilePress plugin (up to 4.16.11) with a CVSS score of 7.1, allowing authenticated users to bypass payment for memberships. Upgrade to 4.16.12 to mitigate this high-severity remote code execution risk.
April 6, 2026
CVE-2026-0738: Shortcodes Ultimate <= 7.4.8 authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0738 affects the Shortcodes Ultimate plugin (up to 7.4.8) with a CVSS score of 6.4. Authenticated users can exploit a stored XSS vulnerability. Upgrade to version 7.4.9 to mitigate this risk.
April 6, 2026
CVE-2026-2437: WP Travel Engine Travel and Tour Booking Plugin <= 6.7.5 Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode PoC, Patch Analysis & Rule
CVE-2026-2437 affects WP Travel Engine plugin versions up to 6.7.5, allowing authenticated users to exploit stored XSS due to insufficient input sanitization. Update to version 6.7.6 to mitigate this medium severity vulnerability.
April 6, 2026
CVE-2026-0552: Simple Shopping Cart <= 5.2.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0552 affects the WordPress Simple Paypal Shopping Cart plugin (up to version 5.2.4) with a medium severity score of 6.4. Users should upgrade to version 5.2.5 to mitigate the stored XSS risk.
April 6, 2026
CVE-2026-2600: ElementsKit Elementor Addons and Templates <= 3.7.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget PoC, Patch Analysis & Rule
CVE-2026-2600 affects the ElementsKit Lite plugin (up to version 3.7.9) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, so update to version 3.8.0 to mitigate risks.
April 6, 2026
CVE-2025-15064: Ultimate Member <= 2.11.1 Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets PoC, Patch Analysis & Rule
CVE-2025-15064 affects the Ultimate Member plugin (up to v2.11.1) with a CVSS score of 6.4. It allows authenticated users to exploit stored XSS in user descriptions. Update to v2.11.2 to mitigate this risk.
April 6, 2026
CVE-2026-4896: WCFM WooCommerce Frontend Manager <= 6.7.25 Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation PoC, Patch Analysis & Rule
CVE-2026-4896 affects the WCFM – Frontend Manager plugin for WordPress (up to version 6.7.25) with a CVSS score of 8.1. Authenticated attackers can exploit this high-severity vulnerability to manipulate orders and posts. Update to 6.7.26.
April 6, 2026
CVE-2026-0664: Royal Elementor Addons <= 1.7.1049 Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass PoC, Patch Analysis & Rule
CVE-2026-0664 affects the Royal Elementor Addons plugin for WordPress (up to version 1.7.1049) with a medium severity CVSS score of 6.4. Patch to version 1.7.1050 to mitigate the stored XSS risk from authenticated attackers.
April 6, 2026
CVE-2026-0737: Shortcodes Ultimate <= 7.4.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0737 affects the Shortcodes Ultimate plugin (up to v7.4.7) with a CVSS score of 6.4. This stored XSS vulnerability allows authenticated users to inject scripts, impacting site security. Upgrade to v7.4.8 to mitigate.
April 6, 2026
CVE-2025-13368: Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13368 affects the Xpro Elementor Addons plugin (up to v1.4.20) with a medium severity CVSS score of 6.4, allowing authenticated users to inject scripts via the Pricing Widget. Patch to mitigate XSS risks.
April 6, 2026
CVE-2026-2924: Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' PoC, Patch Analysis & Rule
CVE-2026-2924 affects the Gutenverse plugin (up to 3.4.6) with a CVSS score of 6.4. This medium severity XSS vulnerability allows authenticated users to inject scripts. Update to version 3.4.7 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.