AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-25438: Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25438 affects the Unlimited Blocks plugin for WordPress (up to version 1.2.8) with a CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability, making patching essential.
April 6, 2026
CVE-2026-24376: WPVulnerability <= 4.2.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24376 affects the WPVulnerability plugin (up to 4.2.1) with a medium severity (CVSS 4.3) flaw allowing unauthorized access to sensitive data. Update to version 4.2.1.1 to mitigate this risk.
April 6, 2026
CVE-2026-25446: Wishlist Member <= 3.29.0 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-25446 affects the Wishlist Member plugin for WordPress (up to 3.29.0) with a CVSS score of 8.8. This high-severity file upload vulnerability allows authenticated users to upload malicious files, risking remote code execution.
April 6, 2026
CVE-2026-32565: Contextual Related Posts < 4.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32565 affects the Contextual Related Posts plugin for WordPress (up to version 4.2.2) with a medium severity (CVSS 5.3). Patch to prevent unauthorized access to sensitive data through AJAX endpoints.
April 6, 2026
CVE-2026-25430: Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25430 affects the Cf7 Mailchimp plugin (v1.2.2) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v1.2.3 to mitigate this risk.
April 6, 2026
CVE-2026-25013: Phox Hosting <= 2.0.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25013 affects the Phox Hosting plugin (up to v2.0.8) with a medium severity CVSS score of 6.1. Users should patch to mitigate the reflected XSS risk that allows script injection by unauthenticated attackers.
April 6, 2026
CVE-2026-24989: SUMO Affiliates Pro < 11.4.0 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-24989 affects the SUMO Affiliates Pro plugin (up to version 11.4.0) with a high severity CVSS score of 8.1 due to a PHP Object Injection vulnerability. Patching is essential to prevent potential system compromise.
April 6, 2026
CVE-2026-25317: Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25317 affects the Woocommerce Delivery Notes plugin (up to v5.9.0) with a CVSS score of 5.3. It allows unauthorized access to order documents; update to v6.0.0 to mitigate this remote code execution risk.
April 6, 2026
CVE-2026-24362: Ultimate Post Kit Addons for Elementor <= 4.0.21 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24362 affects the Ultimate Post Kit plugin (up to v4.0.21) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this flaw for unauthorized actions. Upgrade to v4.0.22 to mitigate risks.
April 6, 2026
CVE-2026-25429: Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-25429 affects the Nexa Blocks plugin (up to version 1.1.1) with a high severity CVSS score of 8.1 due to a file upload vulnerability. Users should patch immediately to prevent potential PHP object injection attacks.
April 6, 2026
CVE-2026-25306: XStore Core <= 5.6.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25306 affects the XStore Core Plugin for WordPress (versions
April 6, 2026
CVE-2026-25447: Widget Wrangler <= 2.3.9 Authenticated (Author+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2026-25447 affects the Widget Wrangler plugin for WordPress, allowing remote code execution for authenticated users in versions up to 2.3.9. With a CVSS score of 8.8, patching is crucial to mitigate potential server exploitation.
April 6, 2026
CVE-2026-24993: Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-24993 affects the Webd Woocommerce Advanced Reporting Statistics plugin (up to v4.1.3) with a high severity SQL injection vulnerability (CVSS 7.5). Update to v4.1.4 to mitigate risks of unauthorized data access.
April 6, 2026
CVE-2026-24378: EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.0 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-24378 affects the Eventprime Event Calendar Management plugin (up to v4.2.8.0) with a high severity CVSS score of 8.1. Patch to v4.2.8.1 to mitigate risks of PHP object injection and potential code execution.
April 6, 2026
CVE-2026-25437: GZSEO <= 2.0.14 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25437 affects the Gzseo plugin (up to version 2.0.14) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should patch to the latest version to mitigate risks.
April 6, 2026
CVE-2026-25462: avalex – Automatisch sichere Rechtstexte <= 3.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25462 affects the Avalex plugin (up to v3.1.3) with a medium severity (CVSS 5.3) vulnerability. Unauthenticated attackers can exploit this flaw for unauthorized actions. Users should patch to the latest version to mitigate risks.
April 6, 2026
CVE-2026-24987: Activity Log for WordPress <= 1.2.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24987 affects the Winterlock plugin (up to v1.2.7) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Upgrade to v1.2.8 to mitigate risks.
April 6, 2026
CVE-2026-25309: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.10.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25309 affects the PublishPress Authors plugin (up to v4.10.1) with a CVSS score of 5.3. Unauthenticated attackers can modify post authors. Update to v4.11.0 to mitigate this risk.
April 6, 2026
CVE-2026-25460: Ave Core <= 2.9.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25460 affects the Ave Core plugin (up to v2.9.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Ensure you update to the patched version to mitigate this risk.
April 6, 2026
CVE-2026-32586: Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32586 affects the WooCommerce Jetpack plugin (up to version 7.11.3) with a medium severity CVSS score of 5.3. It allows unauthorized actions via AJAX. Users should patch to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.