AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 25, 2026
CVE-2026-1935: Company Posts for LinkedIn <= 1.0.0 Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion PoC, Patch Analysis & Rule
CVE-2026-1935 affects the Company Posts for LinkedIn plugin (v1.0.0) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can delete LinkedIn post data, so ensure you update to the patched version.
March 25, 2026
CVE-2026-1253: Group Chat & Video Chat by AtomChat <= 1.1.7 Missing Authorization to Authenticated (Subscriber+) Plugin Options Update PoC, Patch Analysis & Rule
CVE-2026-1253 affects the AtomChat plugin for WordPress (up to version 1.1.7) with a medium severity CVSS score of 5.3. Authenticated users can modify critical settings; update to version 1.1.8 to mitigate this risk.
March 25, 2026
CVE-2026-2121: Weaver Show Posts <= 1.8.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting PoC, Patch Analysis & Rule
CVE-2026-2121 affects the Weaver Show Posts plugin (up to 1.8.1) with a medium severity CVSS score of 4.4. Administrators can exploit this stored XSS vulnerability, so ensure to patch or implement WAF coverage.
March 25, 2026
CVE-2026-4766: Easy Image Gallery <= 1.5.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta PoC, Patch Analysis & Rule
CVE-2026-4766 affects the Easy Image Gallery plugin for WordPress (up to 1.5.3) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure you update to the patched version.
March 25, 2026
CVE-2026-1806: Tour & Activity Operator Plugin for TourCMS <= 1.7.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1806 affects the Tour Operator Plugin (up to version 1.7.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should patch to mitigate risks from authenticated attackers injecting scripts.
March 25, 2026
CVE-2026-2277: rexCrawler <= 1.0.15 Reflected Cross-Site Scripting via 'url' and 'regex' Parameters PoC, Patch Analysis & Rule
CVE-2026-2277 affects the Rexcrawler plugin (v1.0.15) with a CVSS score of 6.1. It allows unauthenticated attackers to exploit reflected XSS via the 'url' and 'regex' parameters. Patching is essential to mitigate this risk.
March 25, 2026
CVE-2026-1822: WP NG Weather <= 1.0.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1822 affects the WP NG Weather plugin (up to v1.0.9) with a medium severity CVSS of 6.4 due to stored XSS vulnerabilities. Ensure you update to the patched version to mitigate risks from potential script injections.
March 25, 2026
CVE-2026-2440: SurveyJS: Drag & Drop Form Builder <= 2.5.3 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-2440 affects the SurveyJS plugin for WordPress (up to version 2.5.3) with a CVSS score of 7.2. This high-severity stored XSS vulnerability can be mitigated by updating to the patched version.
March 25, 2026
CVE-2026-1313: MimeTypes Link Icons <= 3.2.20 Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content PoC, Patch Analysis & Rule
CVE-2026-1313 affects the Mimetypes Link Icons plugin for WordPress (up to v3.2.20) with a CVSS score of 8.3. Authenticated users can exploit this SSRF vulnerability, making it crucial to patch or mitigate immediately.
March 25, 2026
CVE-2026-2279: myLinksDump <= 1.6 Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters PoC, Patch Analysis & Rule
CVE-2026-2279 affects the myLinksDump plugin for WordPress, with a CVSS score of 7.2. This high-severity SQL injection vulnerability allows authenticated attackers to extract sensitive data. Update to the patched version to mitigate risks.
March 25, 2026
CVE-2026-1503: login_register <= 1.2.0 Cross-Site Request Forgery to Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1503 affects the Login Register plugin for WordPress (up to version 1.2.0) with a medium severity (CVSS 4.3) XSS vulnerability. Ensure you update to the patched version to mitigate the risk of script injection.
March 25, 2026
CVE-2026-2427: itsukaita <= 0.1.2 Reflected Cross-Site Scripting via 'day_from' Parameter PoC, Patch Analysis & Rule
CVE-2026-2427 affects the Itsukaita plugin for WordPress (up to version 0.1.2) with a medium severity (CVSS 6.1) reflected cross-site scripting vulnerability. Ensure you update to the patched version to mitigate potential attacks.
March 25, 2026
CVE-2026-2720: Hr Press Lite <= 1.0.2 Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure PoC, Patch Analysis & Rule
CVE-2026-2720 affects Hr Press Lite plugin (v1.0.2) with a medium severity (CVSS 6.5). It allows authenticated users to access sensitive employee data. Ensure you update to the patched version to mitigate this risk.
March 25, 2026
CVE-2026-2723: Post Snippits <= 1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update PoC, Patch Analysis & Rule
CVE-2026-2723 affects the Post Snippits plugin for WordPress (version 1.0 and earlier) with a CVSS score of 6.1. Ensure you patch to mitigate the risk of CSRF attacks that could allow unauthorized changes to settings.
March 25, 2026
CVE-2026-2496: Ed’s Font Awesome <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-2496 affects the Ed's Font Awesome plugin for WordPress (up to version 2.0) with a CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so patching is essential to mitigate risks.
March 25, 2026
CVE-2026-2424: Reward Video Ad for WordPress <= 1.6 Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings PoC, Patch Analysis & Rule
CVE-2026-2424 affects the Applixir plugin (up to version 1.6) with a medium severity (CVSS 4.4) due to stored XSS vulnerabilities. Admins should patch to mitigate risks from potential script injections.
March 25, 2026
CVE-2026-2503: ElementCamp <= 2.3.6 Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter PoC, Patch Analysis & Rule
CVE-2026-2503 affects the Element Camp plugin for WordPress (up to version 2.3.6) with a medium severity SQL injection vulnerability. Authenticated users can exploit this to extract sensitive data; ensure timely patching.
March 25, 2026
CVE-2026-2501: Ed’s Social Share <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-2501 affects the Eds Social Share plugin (up to v2.0) with a CVSS score of 6.4. This medium-severity XSS vulnerability allows authenticated users to inject scripts. Ensure you update to the patched version to mitigate risks.
March 25, 2026
CVE-2026-4161: Review Map by RevuKangaroo <= 1.7 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2026-4161 affects the Review Map By RevuKangaroo plugin (up to v1.7) with a medium severity (CVSS 4.4) cross-site scripting vulnerability. Admins should patch to prevent potential script injection risks.
March 25, 2026
CVE-2026-1851: iVysilani Shortcode <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1851 affects the iVysilani Shortcode plugin for WordPress (up to version 3.0) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated users can inject scripts; update to the patched version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.