AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 10, 2026
CVE-2026-65518: Accept Donations with PayPal & Stripe <= 1.5.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65518 affects the Easy Paypal Donation plugin for WordPress (up to version 1.5.5) with a medium severity CVSS score of 6.4. Users should upgrade to version 1.5.6 to mitigate stored XSS risks.
August 10, 2026
CVE-2026-65529: Graphina – Charts and Graphs For Elementor <= 3.1.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65529 affects the Graphina Elementor Charts And Graphs plugin (up to v3.1.12) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity vulnerability, so update to the patched version to mitigate risks.
August 10, 2026
CVE-2026-59526: MapSVG <= 8.14.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59526 affects the MapSVG plugin for WordPress (up to version 8.14.0) with a high severity SQL injection vulnerability (CVSS 7.5). Patch immediately to prevent unauthorized data access.
August 10, 2026
CVE-2026-59539: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-59539 affects the Paid Member Subscriptions plugin (up to v3.0.7) with a medium severity (CVSS 4.3) IDOR vulnerability. Authenticated users can manipulate payment records; update to v3.0.8 to mitigate.
August 10, 2026
CVE-2026-65531: Qubely – Advanced Gutenberg Blocks <= 1.8.14 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65531 affects the Qubely plugin for WordPress (up to version 1.8.14) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized actions. Users should update to the patched version to mitigate risks.
August 10, 2026
CVE-2026-59549: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59549 affects the Buddypress Media plugin (up to version 4.7.10) with a high severity CVSS score of 7.5 due to SQL injection. Users should upgrade to version 4.7.11 to mitigate potential data exposure risks.
August 10, 2026
CVE-2026-65528: BSK PDF Manager <= 3.8 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
The BSK PDF Manager plugin for WordPress, versions 3.8 and below, has a medium severity Stored Cross-Site Scripting vulnerability (CVE-2026-65528). Ensure to update to the patched version to mitigate risks from authenticated attackers.
August 10, 2026
CVE-2026-65512: WP Activity Log <= 5.6.4 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65512 affects the WP Security Audit Log plugin (up to 5.6.4) with a medium severity (CVSS 4.3) Cross-Site Request Forgery vulnerability. Update to version 5.6.5 to mitigate unauthorized actions.
August 10, 2026
CVE-2026-65526: Visualizer – Tables & Charts Manager with Built-in AI Generator <= 4.0.1 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65526 affects the Visualizer plugin for WordPress (up to version 4.0.1) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to version 4.0.2 to mitigate risks of data exposure.
August 10, 2026
CVE-2026-59551: rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59551 affects Buddypress Media plugin versions up to 4.7.10 with a medium severity (CVSS 6.5) SQL injection vulnerability. Update to 4.7.11 to mitigate risks of data extraction by authenticated users.
August 10, 2026
CVE-2026-59550: AWP Classifieds <= 4.4.7 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59550 affects Another Wordpress Classifieds Plugin versions up to 4.4.7, exposing a high severity SQL injection risk (CVSS 7.5). Users should upgrade to 4.4.8 to mitigate potential data breaches.
August 10, 2026
CVE-2026-65532: افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 Authenticated (Shop manager+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65532 affects the Persian WooCommerce SMS plugin (up to 7.2.2) with a medium severity score of 4.9. Authenticated attackers can exploit SQL injection to access sensitive data. Update to the patched version to mitigate risks.
August 10, 2026
CVE-2026-59538: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.7 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59538 affects the GamiPress plugin (up to version 7.9.7) with a high severity SQL injection vulnerability (CVSS 7.5). Update to version 7.9.8 to mitigate risks of data exposure.
August 10, 2026
CVE-2026-65537: Cyr to Lat Reloaded – Transliteration of Links and File Names <= 1.3.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65537 affects the Cyr And Lat plugin for WordPress (up to v1.3.3) with a medium severity CVSS score of 4.3. Ensure you update to v1.3.4 to mitigate unauthorized access risks.
August 10, 2026
CVE-2026-59528: ShipTime: Discount Shipping <= 1.1.1 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-59528 affects the Shiptime Discount Shipping plugin (versions
August 10, 2026
CVE-2026-65539: Kwayy HTML Sitemap <= 4.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65539 affects the Kwayy HTML Sitemap plugin for WordPress (up to version 4.0) with a medium severity CVSS score of 4.3. Ensure nonce validation is implemented to mitigate potential CSRF attacks.
August 9, 2026
CVE-2026-65520: WP OAuth Server ( Login with WordPress ) <= 6.2.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65520 affects the Miniorange OAuth 20 Server plugin (up to version 6.2.0) with a CVSS score of 7.5. This SQL injection vulnerability allows unauthenticated attackers to access sensitive data. Upgrade to 6.2.1 to mitigate risks.
August 9, 2026
CVE-2026-65513: Simply Schedule Appointments <= 1.6.12.10 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65513 affects Simply Schedule Appointments plugin versions up to 1.6.12.10 with a high severity CVSS of 7.2. Ensure you update to version 1.6.12.11 to mitigate the Stored XSS vulnerability.
August 9, 2026
CVE-2026-25403: Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25403 affects the Ultimate Store Kit plugin for WordPress (up to v3.0.5), allowing remote code execution due to missing capability checks. Users should patch to mitigate unauthorized access risks.
August 9, 2026
CVE-2026-65547: Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65547 affects the Creative Mail By Constant Contact plugin (up to 1.6.9) with a medium severity CVSS of 6.5. Authenticated users can exploit SQL injection vulnerabilities, making patching essential for security.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.