AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 1, 2026
CVE-2026-25371: Lumise Product Designer < 2.0.9 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-25371 affects the Lumise Product Designer plugin (up to version 2.0.9) with a high severity SQL injection vulnerability (CVSS 7.5). Unauthenticated attackers can exploit this flaw to extract sensitive database information.
April 1, 2026
CVE-2026-4257: Contact Form by Supsystic <= 1.7.36 Unauthenticated Server-Side Template Injection via Prefill Functionality PoC, Patch Analysis & Rule
CVE-2026-4257 exposes the Contact Form By Supsystic plugin (versions
March 30, 2026
CVE-2026-32520: RewardsWP – Loyalty Points & Referral Program for WooCommerce <= 1.0.4 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-32520 affects the RewardsWP plugin for WordPress, with a critical CVSS score of 9.8. Upgrade to version 1.0.5 to mitigate the unauthenticated privilege escalation risk.
March 30, 2026
CVE-2026-3339: Keep Backup Daily <= 2.1.1 Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter PoC, Patch Analysis & Rule
CVE-2026-3339 affects the Keep Backup Daily plugin (up to v2.1.1) with a low severity (CVSS 2.7) local file inclusion vulnerability. Update to v2.1.3 to mitigate risks from authenticated attackers listing server directory contents.
March 30, 2026
CVE-2026-32542: Avada (Fusion) Builder < 3.15.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32542 affects the Fusion Builder plugin for WordPress (up to version 3.15.0) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version.
March 30, 2026
CVE-2026-3577: Keep Backup Daily <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title PoC, Patch Analysis & Rule
CVE-2026-3577 affects the Keep Backup Daily plugin (up to v2.1.2) with a medium severity CVSS score of 4.4. Admins should update to v2.1.3 to mitigate the stored XSS risk from insufficient output escaping.
March 30, 2026
CVE-2026-32498: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32498 affects the Custom Registration Form Builder With Submission Manager plugin (up to version 6.0.7.6), allowing unauthorized access. Update to version 6.0.7.7 to mitigate this medium severity vulnerability.
March 30, 2026
CVE-2026-25361: Event Booking Manager for WooCommerce <= 5.1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25361 affects the Mage Eventpress plugin (up to v5.1.4) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this XSS vulnerability; ensure you update to the patched version for protection.
March 30, 2026
CVE-2026-32499: WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32499 reveals a high-severity SQL injection vulnerability in the WPBot plugin for WordPress, affecting versions up to 7.7.9. Update to 7.8.0 to mitigate risks of unauthorized database access.
March 30, 2026
CVE-2026-3567: RepairBuddy <= 4.1132 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action PoC, Patch Analysis & Rule
CVE-2026-3567 affects the Computer Repair Shop plugin (versions ≤4.1132) with a medium severity (CVSS 5.3). Authenticated users can modify admin settings. Update to version 4.1133 to mitigate this risk.
March 30, 2026
CVE-2026-2430: Autoptimize <= 3.1.14 Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes PoC, Patch Analysis & Rule
CVE-2026-2430 affects the Autoptimize plugin (up to v3.1.14) with a medium severity (CVSS 6.4) XSS vulnerability. Patch to v3.1.15 to mitigate risks from authenticated attackers injecting scripts into pages.
March 30, 2026
CVE-2026-2352: Autoptimize <= 3.1.14 Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value PoC, Patch Analysis & Rule
CVE-2026-2352 affects the Autoptimize plugin (up to v3.1.14) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to v3.1.15 to mitigate risks from authenticated attackers injecting scripts.
March 30, 2026
CVE-2026-32546: Membership Plugin – Restrict Content <= 3.2.22 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32546 affects the Restrict Content plugin for WordPress (up to 3.2.22) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to version 3.2.23 to mitigate risks.
March 30, 2026
CVE-2026-32494: Image Slider by Ays- Responsive Slider and Carousel <= 2.7.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32494 affects Ays Slider plugin versions up to 2.7.1, with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts. Update to version 2.7.2 to mitigate risks.
March 30, 2026
CVE-2026-32522: WooCommerce Support Ticket System < 18.5 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2026-32522 affects the WooCommerce Support Ticket System plugin (up to version 18.5) with a critical CVSS score of 9.1. Unauthenticated attackers can delete arbitrary files, risking remote code execution. Patching is essential.
March 30, 2026
CVE-2026-32536: Green Downloads <= 2.08 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-32536 affects the Halfdata Paypal Green Downloads plugin (up to v2.08) with a CVSS score of 8.8. This high-severity file upload vulnerability allows authenticated users to upload arbitrary files, risking remote code execution...
March 30, 2026
CVE-2026-32521: WP Custom Admin Interface <= 7.42 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32521 affects the WP Custom Admin Interface plugin (up to version 7.42) with a medium severity CVSS score of 6.4. Patch to version 7.43 to mitigate the risk of stored cross-site scripting attacks.
March 30, 2026
CVE-2026-25390: New User Approve <= 3.2.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25390 affects the New User Approve plugin (up to version 3.2.3) with a CVSS score of 4.3. Authenticated attackers can exploit this medium-severity flaw to perform unauthorized actions. Patching is recommended.
March 30, 2026
CVE-2026-32492: My Tickets – Accessible Event Ticketing <= 2.1.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32492 affects the My Tickets plugin (up to v2.1.1) with a medium severity CVSS score of 5.3. It allows unauthorized access due to missing capability checks. Update to v2.1.2 to mitigate this vulnerability.
March 30, 2026
CVE-2026-32441: Comments Import & Export <= 2.4.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32441 affects the Comments Import Export Woocommerce plugin (up to v2.4.9) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Update to v2.5.0 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.