AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-32539: PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.7.23 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32539 affects the Revisionary plugin for WordPress, with a CVSS score of 7.5. Users should update to version 3.7.24 to mitigate the high-risk SQL injection vulnerability that allows unauthorized database access.
April 6, 2026
CVE-2026-4350: Perfmatters <= 2.5.9.1 Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter PoC, Patch Analysis & Rule
CVE-2026-4350 affects the Perfmatters plugin (up to version 2.5.9.1) with a CVSS score of 8.1. This high-severity file upload vulnerability allows authenticated users to delete critical files. Patch immediately.
April 6, 2026
CVE-2026-34890: MSTW League Manager <= 2.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-34890 affects the MSTW League Manager plugin for WordPress (up to version 2.10) with a medium severity CVSS score of 6.4. Ensure to patch to prevent authenticated attackers from executing stored XSS.
April 6, 2026
CVE-2026-32497: User Verification by PickPlugins <= 2.0.45 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32497 affects the User Verification plugin for WordPress (up to v2.0.45) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version.
April 6, 2026
CVE-2026-25357: Indeed Membership Pro <= 13.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25357 affects the Indeed Membership Pro plugin (up to version 13.7) with a CVSS score of 5.3, allowing unauthorized access. Users should patch to mitigate potential risks.
April 6, 2026
CVE-2026-34887: Kubio AI Page Builder <= 2.7.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-34887 affects the Kubio AI Page Builder plugin (up to v2.7.0) with a medium severity CVSS score of 6.4 due to stored cross-site scripting. Users should update to v2.7.1 to mitigate this risk.
April 6, 2026
CVE-2026-1430: WP Lightbox 2 < 3.0.7 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1430 affects the WP Lightbox 2 plugin (up to version 3.0.7) with a medium severity CVSS score of 4.4. Administrators should patch to prevent stored XSS risks in multi-site setups.
April 6, 2026
CVE-2026-23972: Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-23972 affects the Booking And Rental Manager For WooCommerce plugin (up to v2.6.0) with a medium severity (CVSS 4.3). Patching is crucial as it allows unauthorized actions by authenticated users.
April 6, 2026
CVE-2026-32501: WP Configurator Pro <= 3.7.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32501 affects WP Configurator Pro versions up to 3.7.9, allowing authenticated users to perform unauthorized actions due to a missing capability check. Update to the patched version to mitigate this medium severity vulnerability.
April 6, 2026
CVE-2026-25339: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2026-25339 affects WPForms Lite versions up to 1.9.8.7, allowing unauthenticated attackers to expose sensitive data. Upgrade to version 1.9.9.2 to mitigate this medium severity vulnerability.
April 6, 2026
CVE-2026-25035: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25035 affects the Contest Gallery plugin (up to version 28.1.2.2) with a medium severity CVSS score of 5.3, allowing unauthorized access. Users should update to version 28.1.3 to mitigate this vulnerability.
April 6, 2026
CVE-2026-25344: Review Schema – Review & Structure Data Schema Plugin <= 2.2.6 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-25344 affects the Review Schema plugin (up to v2.2.6) with a CVSS score of 4.3. Authenticated attackers can access sensitive data. Upgrade to v2.2.7 to mitigate this risk.
April 6, 2026
CVE-2026-25377: Addon Jobsearch Chat <= 3.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-25377 reveals a high-severity SQL injection vulnerability in the Addon Jobsearch Chat plugin for WordPress (versions 3.0 and earlier). Unauthenticated attackers can exploit this flaw to access sensitive data; patching is essential.
April 6, 2026
CVE-2026-25376: Addon Jobsearch Chat <= 3.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25376 affects the Addon Jobsearch Chat plugin for WordPress (up to version 3.0) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure you update to the patched version to mitigate potential attacks.
April 6, 2026
CVE-2026-32535: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-32535 affects the Js Support Ticket plugin (versions up to 3.0.3) with a medium severity CVSS score of 4.3. Users should upgrade to 3.0.4 to mitigate unauthorized access risks.
April 6, 2026
CVE-2026-32484: weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.26 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-32484 affects the Weforms plugin (up to 1.6.26) with a high severity CVSS score of 8.1 due to a PHP Object Injection vulnerability. Users should upgrade to version 1.6.27 to mitigate risks of remote code execution.
April 6, 2026
CVE-2026-25026: Team – Team Members Showcase Plugin <= 5.0.11 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25026 affects the Tlp Team plugin (up to version 5.0.11) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to version 5.0.12 to mitigate risks.
April 6, 2026
CVE-2026-25327: Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25327 affects the Restaurant Reservations plugin (up to v2.7.9) with a medium severity CVSS score of 5.3. Unauthenticated attackers can cancel reservations; update to v2.7.10 to mitigate this risk.
April 6, 2026
CVE-2026-32485: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32485 affects the Wp User Frontend plugin (up to version 4.2.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to version 4.2.9 to mitigate risks.
April 6, 2026
CVE-2026-25334: Salon Booking System Pro < 10.30.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25334 affects the Salon Booking Plugin Pro (up to version 10.30.12) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this flaw for unauthorized actions. Ensure to update to the patched version.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.