AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-24983: UpSolution Core <= 8.41 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24983 affects the Us Core plugin for WordPress (up to version 8.41) with a medium severity CVSS score of 6.1. Ensure to patch to mitigate the reflected XSS risk from insufficient input sanitization.
April 6, 2026
CVE-2026-4347: MW WP Form <= 5.1.0 Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir PoC, Patch Analysis & Rule
CVE-2026-4347 affects MW WP Form plugin versions up to 5.1.0, with a CVSS score of 8.1. This high-severity file upload vulnerability allows unauthenticated attackers to move files on the server. Update to version 5.1.1 to mitigate risks.
April 6, 2026
CVE-2026-0688: Webmention <= 5.6.2 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-0688 affects the Webmention plugin for WordPress (up to 5.6.2) with a medium severity (CVSS 6.4) SSRF vulnerability. Users should upgrade to version 5.7.0 to mitigate potential unauthorized access to internal services.
April 6, 2026
CVE-2026-32526: Abandoned Cart Recovery for WooCommerce <= 1.1.10 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32526 affects Woo Abandoned Cart Recovery plugin versions up to 1.1.10, with a CVSS score of 7.2. Unauthenticated attackers can exploit this XSS vulnerability, so update to the patched version to mitigate risks.
April 6, 2026
CVE-2026-5032: W3 Total Cache <= 2.9.3 Unauthenticated Security Token Exposure via User-Agent Header PoC, Patch Analysis & Rule
CVE-2026-5032 affects W3 Total Cache plugin versions up to 2.9.3 with a CVSS score of 7.5. It allows remote code execution via exposed security tokens. Upgrade to 2.9.4 to mitigate this high-severity vulnerability.
April 6, 2026
CVE-2026-0686: Webmention <= 5.6.2 Unauthenticated Blind Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-0686 affects the Webmention plugin for WordPress (up to version 5.6.2) with a CVSS score of 7.2. Update to version 5.7.0 to mitigate the high-risk SSRF vulnerability that allows unauthenticated attackers to make arbitrary web...
April 6, 2026
CVE-2026-32540: Online Scheduling and Appointment Booking System – Bookly <= 26.7 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32540 affects the Bookly Responsive Appointment Booking Tool (up to version 26.7) with a medium severity CVSS of 6.1. Users should update to version 26.8 to mitigate reflected XSS risks.
April 6, 2026
CVE-2026-32495: WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups <= 2.10.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32495 affects the WP Terms Popup plugin (up to v2.10.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized actions. Update to v2.11.0 to mitigate this risk.
April 6, 2026
CVE-2026-3572: iTracker360 <= 2.2.0 Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field PoC, Patch Analysis & Rule
CVE-2026-3572 affects the iTracker360 plugin (up to version 2.2.0) with a CVSS score of 6.1. It allows unauthenticated attackers to inject scripts via CSRF. Ensure you update to the patched version to mitigate this risk.
April 6, 2026
CVE-2026-32530: Creator LMS – Online Courses and eLearning Plugin <= 1.1.18 Authenticated (Contributor+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-32530 affects the Creator LMS plugin (up to v1.1.18) with a high severity CVSS score of 8.8. Authenticated users can escalate privileges to admin. Update to v1.1.19 to mitigate this risk.
April 6, 2026
CVE-2026-32513: JS Archive List <= 6.1.7 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-32513 affects the Jquery Archive List Widget plugin (up to v6.1.7) with a high severity CVSS score of 7.5. Authenticated attackers can exploit a file upload vulnerability; upgrade to v6.2.0 to mitigate risks.
April 6, 2026
CVE-2026-32516: Miraculous Core < 2.1.2 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32516 affects the Miraculouscore plugin for WordPress (up to version 2.1.2) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated users can exploit this flaw to extract sensitive data; patching is essential.
April 6, 2026
CVE-2026-32496: Spam Protect for Contact Form 7 <= 1.2.9 Authenticated (Editor+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-32496 affects the Wp Contact Form 7 Spam Blocker plugin (up to v1.2.9) with a CVSS score of 6.5. Authenticated attackers can delete files, risking remote code execution. Update to v1.2.10 to mitigate this risk.
April 6, 2026
CVE-2026-32538: SMTP Mailer <= 1.1.24 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-32538 affects the SMTP Mailer plugin for WordPress (up to version 1.1.24) with a CVSS score of 7.5. Unauthenticated attackers can access sensitive data, making immediate patching essential.
April 6, 2026
CVE-2026-32527: WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32527 affects the Cf7 Insightly plugin for WordPress (up to version 1.1.5) with a CVSS score of 4.3. Authenticated users can exploit this medium severity flaw, so update to version 1.1.6 to mitigate unauthorized access.
April 6, 2026
CVE-2026-25033: Motta Addons < 1.6.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25033 affects the Motta Addons plugin for WordPress (up to version 1.6.1) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to the patched version to mitigate potential attacks.
April 6, 2026
CVE-2026-4302: WowOptin: Next-Gen Popup Maker <= 1.4.29 Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API PoC, Patch Analysis & Rule
CVE-2026-4302 affects the WowOptin plugin (versions 1.4.29 and earlier) with a high severity CVSS score of 7.2. Patch to version 1.4.30 to mitigate unauthenticated SSRF risks from exposed REST API endpoints.
April 6, 2026
CVE-2026-32519: Bit SMTP – Easy SMTP Solution with Email Logs <= 1.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32519 affects the Bit SMTP plugin for WordPress (up to 1.2.2) with a medium severity (CVSS 5.3) vulnerability. Update to version 1.2.3 to mitigate unauthorized access risks.
April 6, 2026
CVE-2026-31921: Product Rearrange for WooCommerce <= 1.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-31921 affects the Products Rearrange for WooCommerce plugin (version 1.2.2 and earlier) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium severity vulnerability, so patching is essential.
April 6, 2026
CVE-2026-31920: Product Rearrange for WooCommerce <= 1.2.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-31920 affects the Product Rearrange for WooCommerce plugin (up to version 1.2.2) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to access sensitive data. Patch immediately.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.