AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 28, 2026
CVE-2026-3617: Paypal Shortcodes <= 0.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-3617 affects the Paypal Shortcodes plugin for WordPress (up to v0.3) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Ensure to update to the patched version to mitigate potential script injection risks.
March 28, 2026
CVE-2026-3619: Sheets2Table <= 0.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-3619 affects the Sheets2Table plugin for WordPress (up to version 0.4.1) with a medium severity score of 6.4. Authenticated users can exploit this XSS vulnerability, so update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-3651: Build App Online <= 1.0.23 Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action PoC, Patch Analysis & Rule
CVE-2026-3651 affects the Build App Online plugin (v1.0.23) with a CVSS score of 5.3. It allows unauthorized users to modify post authors. Update to the latest version to mitigate this integrity risk.
March 28, 2026
CVE-2026-2294: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2026-2294 affects the Uipress Lite plugin (up to v3.5.09) with a CVSS score of 4.3. It allows authenticated users to modify settings due to a missing capability check. Update to the patched version to mitigate this risk.
March 28, 2026
CVE-2026-1914: FuseDesk <= 6.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1914 affects the FuseDesk WordPress plugin (up to version 6.8) with a medium severity CVSS score of 6.4 due to stored XSS. Users should update to version 6.8.1 to mitigate the risk of script injection.
March 28, 2026
CVE-2026-3354: Wikilookup <= 1.1.5 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting PoC, Patch Analysis & Rule
CVE-2026-3354 affects the Wikilookup plugin (up to v1.1.5) with a medium severity CVSS score of 4.4. It allows authenticated admins to exploit stored XSS. Patching is essential to mitigate potential script injections.
March 28, 2026
CVE-2026-1648: Performance Monitor <= 1.0.6 Unauthenticated Server-Side Request Forgery via 'url' Parameter PoC, Patch Analysis & Rule
CVE-2026-1648 affects the Performance Monitor plugin (up to v1.0.6) with a CVSS score of 7.2. This high-severity SSRF vulnerability allows unauthenticated attackers to execute remote code. Patching is essential to mitigate risks.
March 28, 2026
CVE-2026-1886: Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1886 affects the Go Night Pro plugin (v1.1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-3353: Comment SPAM Wiper <= 1.2.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting PoC, Patch Analysis & Rule
CVE-2026-3353 affects the Comment Spam Wiper plugin (up to v1.2.1) with a medium severity (CVSS 4.4) Stored XSS vulnerability. Admins should patch to prevent script injection risks in multi-site setups.
March 28, 2026
CVE-2026-3641: Appmax <= 1.0.3 Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint PoC, Patch Analysis & Rule
CVE-2026-3641 affects the Appmax plugin for WordPress (up to version 1.0.3) with a CVSS score of 5.3. This medium severity vulnerability allows remote code execution via unauthenticated webhook manipulation. Patching is essential.
March 28, 2026
CVE-2026-3460: REST API TO MiniProgram <= 5.1.2 Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter PoC, Patch Analysis & Rule
CVE-2026-3460 affects the Rest Api To Miniprogram plugin for WordPress (up to version 5.1.2) with a CVSS score of 5.3. Authenticated attackers can modify user metadata; patching is essential to mitigate this risk.
March 28, 2026
CVE-2026-3347: Multi Functional Flexi Lightbox <= 1.2 Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter PoC, Patch Analysis & Rule
CVE-2026-3347 affects the Multi Functional Flexi Lightbox plugin (up to v1.2) with a medium severity (CVSS 5.5) stored XSS vulnerability. Admins should patch to prevent script injection that impacts all users viewing affected content.
March 28, 2026
CVE-2026-3331: Lobot Slider Administrator <= 0.6.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-3331 affects the Lobot Slider Administrator plugin for WordPress (up to v0.6.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized configuration changes.
March 28, 2026
CVE-2026-3332: Xhanch My Advanced Settings <= 1.1.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-3332 affects the Xhanch My Advanced Settings plugin (up to v1.1.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can modify settings, so ensure you update to the patched version.
March 28, 2026
CVE-2026-1899: Any Post Slider <= 1.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1899 affects the Any Post Slider plugin (up to v1.0.4) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated attackers can inject scripts, so ensure you update to the patched version to mitigate risks.
March 28, 2026
CVE-2026-3335: Canto <= 3.1.1 Missing Authorization to Unauthenticated File Upload PoC, Patch Analysis & Rule
CVE-2026-3335 affects the Canto plugin for WordPress (up to 3.1.1) with a medium severity (CVSS 5.3) file upload vulnerability. Unauthenticated attackers can upload arbitrary files, making patching essential for security.
March 26, 2026
CVE-2026-3333: MinhNhut Link Gateway <= 3.6.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-3333 affects the Minhnhut Link Gateway plugin for WordPress (up to version 3.6.1) with a medium severity (CVSS 6.4) XSS vulnerability. Ensure you update to the patched version to mitigate the risk of script injection.
March 25, 2026
CVE-2026-1800: Fonts Manager | Custom Fonts <= 1.2 Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter PoC, Patch Analysis & Rule
CVE-2026-1800 affects the Fonts Manager Custom Fonts plugin for WordPress (up to version 1.2) with a high severity CVSS score of 7.5. Unauthenticated SQL injection can lead to data exposure; update to the patched version to mitigate risks.
March 25, 2026
CVE-2026-3334: CMS Commander <= 2.288 Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter PoC, Patch Analysis & Rule
CVE-2026-3334 affects the CMS Commander Client plugin (up to v2.288) with a CVSS score of 8.8. This high-severity SQL injection allows attackers with API key access to extract sensitive data. Patching is essential.
March 25, 2026
CVE-2026-2837: Ricerca – advanced search <= 1.1.12 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings PoC, Patch Analysis & Rule
CVE-2026-2837 affects the Ricerca Smart Search plugin (up to v1.1.12) with a CVSS score of 4.4. This medium-severity XSS vulnerability requires admin access to exploit, impacting multi-site setups. Patching is essential.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.