AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 29, 2026
CVE-2026-3350: Image Alt Text Manager <= 1.8.2 Authenticated (Author+) Stored Cross-Site Scripting via Post Title PoC, Patch Analysis & Rule
CVE-2026-3350 affects the Alt Manager plugin for WordPress, versions up to 1.8.2, with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability; update to version 1.8.3 to mitigate risks.
March 29, 2026
CVE-2026-32524: Photo Engine (Media Organizer & Lightroom) <= 6.4.9 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2026-32524 affects the Wplr Sync plugin (up to version 6.4.9) with a CVSS score of 8.8. Authenticated attackers can exploit a file upload vulnerability, risking remote code execution. Upgrade to version 6.5.0 to mitigate.
March 28, 2026
CVE-2026-3546: e-shot <= 1.0.2 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-3546 affects the e-shot Form Builder plugin (up to v1.0.2) with a CVSS score of 5.3. Authenticated users can exploit it to access sensitive API tokens. Ensure you update to the patched version to mitigate this risk.
March 28, 2026
CVE-2026-3478: Content Syndication Toolkit <= 1.3 Unauthenticated Server-Side Request Forgery via 'url' Parameter PoC, Patch Analysis & Rule
CVE-2026-3478 affects the Content Syndication Toolkit plugin (up to v1.3) with a high severity CVSS score of 7.2. Unauthenticated SSRF allows attackers to make arbitrary web requests. Update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-3570: Smarter Analytics <= 2.0 Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter PoC, Patch Analysis & Rule
CVE-2026-3570 affects the Smarter Analytics plugin for WordPress (up to version 2.0) with a medium severity (CVSS 5.3). Unauthenticated attackers can reset configurations. Ensure you update to the patched version to mitigate this risk.
March 28, 2026
CVE-2026-3645: Punnel <= 1.3.1 Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-3645 affects the Punnel Landing Page Builder plugin (up to v1.3.1) with a medium severity (CVSS 5.3) vulnerability. Authenticated users can overwrite configurations, including the API key, so patching is essential.
March 28, 2026
CVE-2026-2602: Twentig <= 1.9.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth' PoC, Patch Analysis & Rule
CVE-2026-2602 affects the Twentig plugin for WordPress (up to version 1.9.7) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, making it essential to upgrade to version 2.0 to mitigate risks.
March 28, 2026
CVE-2026-3554: Sherk Custom Post Type Displays <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-3554 affects the Sherk Custom Post Type Displays plugin (up to v1.2.1) with a CVSS score of 6.4. This medium-severity XSS vulnerability allows authenticated attackers to inject scripts. Patching is recommended.
March 28, 2026
CVE-2026-1891: Simple Football Scoreboard <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1891 affects the Simple Football Score Board plugin (v1.0) with a medium severity CVSS score of 6.4. Authenticated users can exploit stored XSS vulnerabilities. Ensure you update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-2351: Task Manager <= 3.0.2 Authenticated (Subscriber+) Arbitrary File Read PoC, Patch Analysis & Rule
CVE-2026-2351 affects the Task Manager plugin (up to version 3.0.2) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit a file upload vulnerability to read sensitive server files. Patching is recommended.
March 28, 2026
CVE-2026-1911: Twitter Feeds <= 1.0.0 Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1911 affects the Twitter Feeds plugin for WordPress (v1.0.0) with a medium severity (CVSS 6.4) due to stored XSS. Authenticated attackers can inject scripts; ensure to patch or mitigate this risk.
March 28, 2026
CVE-2026-1908: Integration with Hubspot Forms <= 1.2.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1908 affects the Integration With Hubspot Forms plugin (up to v1.2.2) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated users can inject scripts, so ensure to update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-4127: Speedup Optimization <= 1.5.9 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-4127 affects the Speedup Optimization plugin (up to v1.5.9) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can alter site optimization settings, so ensure you update to the patched version.
March 28, 2026
CVE-2026-4004: Task Manager <= 3.0.2 Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter PoC, Patch Analysis & Rule
CVE-2026-4004 affects the Task Manager plugin (up to v3.0.2) with a medium severity (CVSS 6.5) vulnerability allowing authenticated users to execute arbitrary shortcodes. Patching is essential to mitigate this remote code execution risk.
March 28, 2026
CVE-2026-4143: Neos Connector for Fakturama <= 0.0.14 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-4143 affects the Neos Connector for Fakturama plugin (up to v0.0.14) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to prevent unauthorized configuration changes.
March 28, 2026
CVE-2026-4069: Alfie – Feed Plugin <= 1.2.1 Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter PoC, Patch Analysis & Rule
CVE-2026-4069 affects the Alfie The Productfeedtool WP Plugin (v1.2.1) with a medium severity (CVSS 6.1) cross-site scripting vulnerability. Ensure you update to the patched version to mitigate potential attacks.
March 28, 2026
CVE-2026-1889: Outgrow <= 2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute PoC, Patch Analysis & Rule
CVE-2026-1889 affects the Outgrow plugin for WordPress (up to version 2.1) with a medium severity CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so ensure you patch to the latest version.
March 28, 2026
CVE-2026-4072: WordPress PayPal Donation <= 1.01 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-4072 affects the WordPress PayPal Donation plugin (up to v1.01) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to the patched version to mitigate potential script injection risks.
March 28, 2026
CVE-2026-3997: Text Toggle <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-3997 affects the Text Toggle plugin for WordPress (up to v1.1) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Users should update to the patched version to mitigate risks from authenticated attackers.
March 28, 2026
CVE-2026-3996: WP Games Embed <= 0.1beta Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-3996 affects the WP Games Embed plugin (version 0.1beta) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should patch to prevent authenticated attackers from injecting malicious scripts.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.