AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-32533: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-32533 affects the LatePoint plugin (up to version 5.2.6) with a medium severity CVSS score of 4.3. Authenticated users can exploit this IDOR vulnerability, so update to version 5.2.7 to mitigate risks.
April 6, 2026
CVE-2026-1233: Text to Speech (TTS) by Mementor <= 1.9.8 Use of Hardcoded Password to Unauthenticated Remote Database Access PoC, Patch Analysis & Rule
CVE-2026-1233 affects the Text To Speech Tts plugin (up to version 1.9.8) with a CVSS score of 7.5. Unauthenticated attackers can exploit hardcoded MySQL credentials, making it crucial to update to version 1.9.9 for protection.
April 1, 2026
CVE-2025-13535: King Addons for Elementor <= 51.1.38 Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets PoC, Patch Analysis & Rule
CVE-2025-13535 affects King Addons for Elementor (up to version 51.1.38) with a medium severity (CVSS 6.4) XSS vulnerability. Update to version 51.1.54 to mitigate risks from authenticated attackers injecting scripts.
April 1, 2026
CVE-2026-3191: Minify HTML <= 2.1.12 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2026-3191 affects the Minify HTML plugin for WordPress (up to 2.1.12) with a medium severity CVSS score of 5.4. Ensure you update to version 2.1.13 to mitigate the Cross-Site Request Forgery risk.
April 1, 2026
CVE-2026-4267: Query Monitor <= 3.20.3 Reflected Cross-Site Scripting via Request URI PoC, Patch Analysis & Rule
CVE-2026-4267 affects Query Monitor versions up to 3.20.3, exposing a high severity cross-site scripting vulnerability (CVSS 7.2). Users should upgrade to version 3.20.4 to mitigate potential attacks.
April 1, 2026
CVE-2026-1877: Auto Post Scheduler <= 1.84 Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page PoC, Patch Analysis & Rule
CVE-2026-1877 affects the Auto Post Scheduler plugin (up to v1.84) with a medium severity (CVSS 6.1) cross-site scripting vulnerability. Ensure to update to the patched version to mitigate potential attacks.
April 1, 2026
CVE-2026-1797: Truebooker Appointment Booking and Scheduler Plugin <= 1.1.4 Sensitive Information Exposure via Views Files PoC, Patch Analysis & Rule
CVE-2026-1797 affects the Truebooker Appointment Booking plugin (up to v1.1.4) with a medium severity CVSS score of 5.3. Patch to v1.1.5 to mitigate sensitive information exposure risks.
April 1, 2026
CVE-2026-3831: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode PoC, Patch Analysis & Rule
CVE-2026-3831 affects the Contact Form Entries plugin (up to v1.4.9) with a medium severity (CVSS 4.3). Patch to v1.5.0 to prevent unauthorized data access by authenticated users.
April 1, 2026
CVE-2026-1834: Ibtana WordPress Website Builder <= 1.2.5.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1834 affects the Ibtana Visual Editor plugin (up to 1.2.5.7) with a medium severity CVSS score of 6.4. Authenticated users can exploit a stored XSS vulnerability; update to version 1.2.5.8 to mitigate risks.
April 1, 2026
CVE-2026-4668: Amelia <= 2.1.2 Authenticated (Manager+) SQL Injection via 'sort' Parameter PoC, Patch Analysis & Rule
CVE-2026-4668 affects the Amelia Booking plugin (up to v2.1.2) with a medium severity (CVSS 6.5) SQL injection risk. Users should upgrade to v2.1.3 to mitigate data extraction risks from authenticated attackers.
April 1, 2026
CVE-2026-3139: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field PoC, Patch Analysis & Rule
CVE-2026-3139 affects the Profile Builder plugin (up to v3.15.5) with a CVSS score of 4.3. Authenticated users can exploit this to change post ownership. Update to v3.15.6 to mitigate this risk.
April 1, 2026
CVE-2026-2480: WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-2480 affects the Shortcodes Ultimate plugin (up to 7.4.10) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, making patching essential.
April 1, 2026
CVE-2026-1710: WooPayments <= 10.5.1 Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax PoC, Patch Analysis & Rule
CVE-2026-1710 affects WooCommerce Payments plugin versions up to 10.5.1, allowing unauthorized data modification. Upgrade to version 10.6.0 to mitigate this medium severity issue with a CVSS score of 6.5.
April 1, 2026
CVE-2026-4020: Gravity SMTP <= 2.1.4 Unauthenticated Sensitive Information Exposure via REST API PoC, Patch Analysis & Rule
CVE-2026-4020 affects the Gravity SMTP plugin for WordPress (up to v2.1.4) with a CVSS score of 7.5. This high-severity vulnerability allows unauthenticated users to access sensitive system configuration data. Patching is essential.
April 1, 2026
CVE-2026-4146: Loco Translate <= 2.8.2 Reflected Cross-Site Scripting via 'update_href' Parameter PoC, Patch Analysis & Rule
CVE-2026-4146 affects the Loco Translate plugin (up to version 2.8.2) with a medium severity XSS vulnerability (CVSS 6.1). Users should update to version 2.8.3 to mitigate risks from potential attacks.
April 1, 2026
CVE-2026-5130: Debugger & Troubleshooter <= 1.3.2 Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation PoC, Patch Analysis & Rule
CVE-2026-5130 affects the Debugger Troubleshooter plugin (up to 1.3.2) with a high severity (CVSS 8.8) vulnerability allowing unauthenticated privilege escalation. Update to version 1.4.0 to mitigate this risk.
April 1, 2026
CVE-2026-3300: Everest Forms Pro <= 1.9.12 Unauthenticated Remote Code Execution via Calculation Field PoC, Patch Analysis & Rule
CVE-2026-3300 is a critical remote code execution vulnerability in Everest Forms Pro (up to 1.9.12) due to improper PHP code handling. Users should patch immediately to mitigate potential server-side attacks.
April 1, 2026
CVE-2026-32541: Premmerce Redirect Manager <= 1.0.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32541 affects the Premmerce Redirect Manager plugin for WordPress (up to 1.0.12) with a CVSS score of 4.3. Patch to 1.0.13 to mitigate unauthorized access risks from authenticated users.
April 1, 2026
CVE-2026-25346: FAQ Builder AYS <= 1.8.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25346 affects the FAQ Builder AYS plugin (up to version 1.8.2) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts. Update to version 1.8.3 to mitigate risks.
April 1, 2026
CVE-2026-32537: Visual Portfolio, Photo Gallery & Post Grid <= 3.5.1 Authenticated (Subscriber+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-32537 affects the Visual Portfolio plugin for WordPress (up to v3.5.1) with a high severity CVSS score of 7.5. It allows authenticated attackers to bypass access controls. Upgrade to v3.5.2 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.