AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-2949: Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget PoC, Patch Analysis & Rule
CVE-2026-2949 affects the Xpro Elementor Addons plugin (v1.4.24) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS via the Icon Box widget, necessitating immediate patching.
April 6, 2026
CVE-2026-3571: Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 Missing Authorization to Unauthenticated Registration Form Status Modification PoC, Patch Analysis & Rule
CVE-2026-3571 affects the Pie Register plugin (up to v3.8.4.8) with a medium severity (CVSS 6.5) vulnerability allowing unauthorized data modification. Update to v3.8.4.9 to mitigate this risk.
April 6, 2026
CVE-2026-25328: Product File Upload for WooCommerce <= 2.2.4 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-25328 affects the Products File Upload for WooCommerce plugin (up to v2.2.4) with a CVSS score of 8.1. It allows unauthenticated file deletion, posing a risk of remote code execution. Ensure you patch to mitigate this...
April 6, 2026
CVE-2026-25018: NaturaLife Extensions <= 2.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25018 affects the NaturaLife Extensions plugin (up to version 2.1) with a medium severity CVSS score of 6.1. Users should patch to prevent reflected XSS attacks that can compromise site security.
April 6, 2026
CVE-2026-25034: KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25034 affects the Kivicare Clinic Management System plugin (up to version 3.6.16) with a medium severity CVSS score of 5.3. Ensure you update to version 4.0.0 to mitigate unauthorized access risks.
April 6, 2026
CVE-2026-32573: Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 Authenticated (Editor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-32573 affects the Nelio A/B Testing plugin (up to version 8.2.7) with a high severity score of 7.2. Authenticated attackers can exploit this remote code execution vulnerability, so update to version 8.2.8 to mitigate risks.
April 6, 2026
CVE-2026-25406: Tutor LMS Pro <= 3.9.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25406 affects Tutor Pro plugin versions up to 3.9.4, allowing unauthorized access due to a missing capability check. Users should update to the patched version to mitigate this medium-severity vulnerability.
April 6, 2026
CVE-2026-25017: NaturaLife Extensions <= 2.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-25017 affects the NaturaLife Extensions plugin for WordPress (up to version 2.1) with a high severity CVSS score of 8.1. This authentication bypass vulnerability allows unauthenticated attackers to execute arbitrary PHP code...
April 6, 2026
CVE-2026-32562: PPWP – Password Protect Pages <= 1.9.15 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32562 affects the Password Protect Page plugin (up to v1.9.15) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this flaw; update to v1.9.16 to mitigate risks.
April 6, 2026
CVE-2026-25414: WPBookit Pro <= 1.6.18 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-25414 affects WPBookit Pro plugin versions up to 1.6.18, allowing authenticated users to escalate privileges. Users should update to the patched version to mitigate this medium severity risk.
April 6, 2026
CVE-2026-23977: Helpdesk Support Ticket System for WooCommerce <= 2.1.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-23977 affects the Support Ticket System For WooCommerce plugin (up to v2.1.2), allowing unauthorized actions via its REST API. Update to v2.1.3 to mitigate this medium severity vulnerability.
April 6, 2026
CVE-2026-24369: The Grid < 2.8.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24369 affects The Grid plugin for WordPress (up to version 2.8.0) with a medium severity (CVSS 4.3). Authenticated attackers can exploit this missing capability check, so patching is essential.
April 6, 2026
CVE-2026-32545: Taboola Pixel <= 1.1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32545 affects the Taboola Pixel plugin for WordPress (versions 1.1.4 and below) with a medium severity CVSS score of 6.1. Users should update to version 1.1.5 to mitigate the reflected XSS vulnerability.
April 6, 2026
CVE-2026-25397: File Uploader for WooCommerce <= 1.0.4 Unauthenticated Path Traversal PoC, Patch Analysis & Rule
CVE-2026-25397 affects the File Uploader for WooCommerce plugin (up to v1.0.4) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this path traversal vulnerability; patching is essential.
April 6, 2026
CVE-2026-25443: Fraud Prevention For WooCommerce and EDD <= 2.3.3 Missing Authorization to Unauthenticated Arbitrary Content Deletion PoC, Patch Analysis & Rule
CVE-2026-25443 affects Woo Blocker Lite version 2.3.3, allowing unauthenticated attackers to execute remote code with a CVSS score of 7.5. Upgrade to version 2.3.4 to mitigate this high-severity vulnerability.
April 6, 2026
CVE-2026-25435: Booking calendar, Appointment Booking System <= 3.2.36 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25435 affects the Booking Calendar plugin (up to version 3.2.36) with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts, impacting user safety. Update to the latest version to mitigate...
April 6, 2026
CVE-2026-25398: Vertex Addons for Elementor <= 1.6.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25398 affects the Addons For Elementor Builder plugin (up to v1.6.4) with a medium severity (CVSS 4.3) vulnerability. Update to v1.7.0 to mitigate unauthorized access risks by authenticated users.
April 6, 2026
CVE-2026-25365: Kargo Takip < 0.2.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25365 affects the Kargo Takip Turkiye plugin (up to version 0.2.4) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this flaw for unauthorized actions, so update to the patched version.
April 6, 2026
CVE-2026-25312: EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25312 affects the Eventprime Event Calendar Management plugin (up to version 4.2.8.3) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Upgrade to version 4.2.8.4 to mitigate this risk.
April 6, 2026
CVE-2026-25445: Wishlist Member <= 3.29.0 Authenticated (Subscriber+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-25445 affects Wishlist Member plugin versions up to 3.29.0, with a CVSS score of 7.5. Authenticated attackers can exploit a file upload vulnerability, risking data integrity. Ensure you update to the patched version.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.