AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 30, 2026
CVE-2026-32523: WPJAM Basic <= 6.9.2 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-32523 affects WPJAM Basic plugin versions up to 6.9.2 with a CVSS score of 8.8. Authenticated attackers can exploit a file upload vulnerability, making patching essential to secure your site.
March 30, 2026
CVE-2026-32534: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32534 affects the Js Support Ticket plugin (up to 3.0.3) with a medium severity (CVSS 6.5) SQL injection vulnerability. Patch to version 3.0.4 to mitigate risks of sensitive data exposure.
March 29, 2026
CVE-2026-3124: Download Monitor <= 5.1.7 Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' PoC, Patch Analysis & Rule
CVE-2026-3124 affects the Download Monitor plugin (up to 5.1.7) with a CVSS score of 7.5. Unauthenticated attackers can exploit this high-severity vulnerability to steal digital goods. Update to version 5.1.8 to mitigate risks.
March 29, 2026
CVE-2026-2375: App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 Unauthenticated Privilege Escalation via 'role' Parameter PoC, Patch Analysis & Rule
CVE-2026-2375 affects the App Builder plugin for WordPress, allowing unauthenticated privilege escalation due to improper role management. Users should update to version 5.5.11 or implement WAF rules to mitigate this medium severity risk.
March 29, 2026
CVE-2026-4077: Ecover Builder For Dummies <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-4077 affects the Ecover Builder For Dummies plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure to patch or mitigate to prevent unauthorized script injection.
March 29, 2026
CVE-2026-4067: Ad Short <= 2.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-4067 affects the Ad Short plugin for WordPress (up to 2.0.1) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts; ensure you update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-4084: fyyd podcast shortcodes <= 0.3.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-4084 affects the Fyyd Podcast Shortcodes plugin (up to v0.3.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS via shortcode attributes, necessitating immediate patching.
March 29, 2026
CVE-2026-4086: WP Random Button <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-4086 affects the WP Random Button plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts via shortcode attributes. Update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-4022: Show Posts list <= 1.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-4022 affects the Show Posts Shortcodes plugin for WordPress, with a medium severity CVSS score of 6.4. Users should update to the patched version to mitigate the risk of stored cross-site scripting attacks.
March 29, 2026
CVE-2026-2468: Quentn WP <= 1.2.12 Unauthenticated SQL Injection via 'qntn_wp_access' Cookie PoC, Patch Analysis & Rule
CVE-2026-2468 affects the Quentn WP plugin (up to version 1.2.12) with a high severity SQL injection vulnerability (CVSS 7.5). Ensure timely patching to prevent unauthorized database access.
March 29, 2026
CVE-2026-3003: Vagaro Booking Widget <= 0.3 Unauthenticated Stored Cross-Site Scripting via 'vagaro_code' PoC, Patch Analysis & Rule
CVE-2026-3003 affects the Vagaro Booking Widget plugin (up to version 0.3) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts. Update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-3506: WP-Chatbot for Messenger <= 4.9 Missing Authorization to Unauthenticated Chatbot Configuration Takeover PoC, Patch Analysis & Rule
CVE-2026-3506 affects the WP Chatbot plugin (up to v4.9) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access to overwrite API tokens. Patch your plugin to mitigate the risk of chatbot hijacking.
March 29, 2026
CVE-2026-4087: Pre* Party Resource Hints <= 1.8.20 Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter PoC, Patch Analysis & Rule
CVE-2026-4087 affects the Pre Party Browser Hints plugin for WordPress, allowing authenticated SQL injection attacks due to insufficient parameter escaping. Update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-2941: Linksy Search and Replace <= 1.0.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details PoC, Patch Analysis & Rule
CVE-2026-2941 affects the Linksy Search And Replace plugin (v1.0.4) with a high severity CVSS score of 8.8. It allows authenticated users to escalate privileges and modify database entries. Update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-3474: EmailKit <= 1.6.3 Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter PoC, Patch Analysis & Rule
CVE-2026-3474 affects Emailkit plugin versions up to 1.6.3, with a CVSS score of 4.9. This medium-severity path traversal vulnerability allows authenticated admins to read arbitrary server files. Upgrade to 1.6.4 to mitigate.
March 29, 2026
CVE-2026-3368: Injection Guard <= 1.2.9 Unauthenticated Stored Cross-Site Scripting via Query Parameter Name PoC, Patch Analysis & Rule
CVE-2026-3368 affects the Injection Guard plugin for WordPress (up to 1.2.9) with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts in the admin log. Update to version 1.3.0 to mitigate.
March 29, 2026
CVE-2026-3516: Contact List <= 3.0.18 Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter PoC, Patch Analysis & Rule
CVE-2026-3516 affects the Contact List plugin for WordPress (up to version 3.0.18) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to version 3.0.19 to mitigate the risk of script injection.
March 29, 2026
CVE-2026-4083: Scoreboard for HTML5 Games Lite <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-4083 affects the Scoreboard For Html5 Game Lite plugin (up to v1.2) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated users can inject scripts, so update to the patched version to mitigate risks.
March 29, 2026
CVE-2026-3584: Kali Forms <= 2.4.9 Unauthenticated Remote Code Execution via form_process PoC, Patch Analysis & Rule
CVE-2026-3584 is a critical remote code execution vulnerability in the Kali Forms plugin for WordPress, affecting versions up to 2.4.9. Upgrade to version 2.4.10 to mitigate this 9.8 CVSS risk.
March 29, 2026
CVE-2026-4261: Expire Users <= 1.2.2 Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields PoC, Patch Analysis & Rule
CVE-2026-4261 affects the Expire Users plugin for WordPress, allowing authenticated users to escalate privileges to Administrator. With a CVSS score of 8.8, patching is critical to mitigate this high-severity vulnerability.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.