AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 24, 2026
CVE-2026-32352: elementor PoC, Patch Analysis & Rule
CVE-2026-32352 affects the Elementor plugin for WordPress, allowing authentication bypass and arbitrary code execution. Users should update to the patched version to mitigate potential risks.
March 24, 2026
CVE-2026-4283: WP DSGVO Tools (GDPR) <= 3.1.38 Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users PoC, Patch Analysis & Rule
CVE-2026-4283 in the Shapepress Dsgvo plugin (up to 3.1.38) allows unauthenticated users to irreversibly destroy non-admin accounts. Update to 3.1.39 to mitigate this critical vulnerability with a CVSS score of 9.1.
March 24, 2026
CVE-2026-3079: LearnDash LMS <= 5.0.3 Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter PoC, Patch Analysis & Rule
CVE-2026-3079 affects the LearnDash LMS plugin (up to 5.0.3) with a medium severity SQL injection vulnerability. Authenticated attackers can exploit this flaw to extract sensitive data; ensure you update to the patched version.
March 24, 2026
CVE-2026-4001: Woocommerce Custom Product Addons Pro <= 5.4.1 Unauthenticated Remote Code Execution via Custom Pricing Formula PoC, Patch Analysis & Rule
CVE-2026-4001 affects Woo Custom Product Addons Pro (up to v5.4.1) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this remote code execution flaw. Ensure you patch to the latest version to mitigate risks.
March 24, 2026
CVE-2026-4662: JetEngine <= 3.8.6.1 Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter PoC, Patch Analysis & Rule
CVE-2026-4662 affects the Jet Engine plugin for WordPress (up to version 3.8.6.1) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows attackers to execute arbitrary SQL commands. Patching is essential.
March 24, 2026
CVE-2026-3138: Product Filter for WooCommerce by WBW <= 3.1.2 Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE PoC, Patch Analysis & Rule
CVE-2026-3138 affects the Woo Product Filter plugin (up to v3.1.2) with a medium severity (CVSS 6.5). Unauthenticated attackers can delete filter configurations. Update to v3.1.3 to mitigate this risk.
March 24, 2026
CVE-2026-4021: Contest Gallery <= 28.1.5 Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion PoC, Patch Analysis & Rule
CVE-2026-4021 affects the Contest Gallery plugin (up to 28.1.5) with a CVSS score of 8.1. This high-severity authentication bypass allows admin account takeover; update to 28.1.6 to mitigate risks.
March 24, 2026
CVE-2026-3533: JupiterX Core <= 4.14.1 Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import PoC, Patch Analysis & Rule
CVE-2026-3533 affects the Jupiter X Core plugin (up to 4.14.1) with a CVSS score of 8.8. Authenticated users can exploit this high-severity XSS vulnerability to upload malicious files. Update to the patched version to mitigate risks.
March 24, 2026
CVE-2026-4056: User Registration & Membership <= 5.1.4 Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation PoC, Patch Analysis & Rule
CVE-2026-4056 affects the User Registration plugin (versions 5.0.1 to 5.1.4) with a medium severity (CVSS 5.4). Patch to version 5.1.5 to prevent unauthorized data modification by authenticated users.
March 24, 2026
CVE-2026-4306: WP Job Portal <= 2.4.8 Unauthenticated SQL Injection via 'radius' Parameter PoC, Patch Analysis & Rule
CVE-2026-4306 affects the WP Job Portal plugin (up to v2.4.8) with a high severity CVSS score of 7.5. This SQL Injection vulnerability allows unauthenticated attackers to extract sensitive data. Update to v2.4.9 to mitigate risks.
March 24, 2026
CVE-2026-3225: LearnPress <= 4.3.2.8 Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion PoC, Patch Analysis & Rule
CVE-2026-3225 affects LearnPress plugin versions up to 4.3.2.8, allowing authenticated users to delete quiz answers due to a missing capability check. Upgrade to version 4.3.3 to mitigate this medium severity vulnerability.
March 24, 2026
CVE-2026-2412: Quiz and Survey Master (QSM) <= 10.3.5 Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter PoC, Patch Analysis & Rule
CVE-2026-2412 affects the Quiz Master Next plugin (up to v10.3.5) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to v11.0.0 to mitigate risks of unauthorized database access.
March 24, 2026
CVE-2026-4066: Smart Custom Fields <= 5.0.6 Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search PoC, Patch Analysis & Rule
CVE-2026-4066 affects the Smart Custom Fields plugin (up to v5.0.6) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can access private content; update to v5.0.7 to mitigate this risk.
March 24, 2026
CVE-2026-1390: Redirect countdown <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1390 affects the Redirect Countdown plugin for WordPress (version 1.0) with a CVSS score of 4.3. It allows unauthenticated attackers to exploit CSRF vulnerabilities. Patching is essential to secure plugin settings.
March 24, 2026
CVE-2026-1393: Add Google Social Profiles to Knowledge Graph Box <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1393 affects the Add Google Social Profiles To Knowledge Graph Box plugin (v1.0) with a CVSS score of 4.3. This medium severity CSRF vulnerability allows attackers to change settings if an admin is tricked into clicking a link...
March 24, 2026
CVE-2026-1378: WP Posts Re-order <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1378 affects the WP Posts Re-order plugin (version 1.0) with a medium severity CVSS score of 4.3. Unauthenticated attackers can exploit a CSRF flaw to alter plugin settings, highlighting the need for immediate patching.
March 24, 2026
CVE-2026-1575: Schema Shortcode <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1575 affects the Schema Shortcode plugin for WordPress (v1.0) with a CVSS score of 6.4. Authenticated users can exploit this medium severity XSS vulnerability, emphasizing the need for timely patching and input sanitization.
March 24, 2026
CVE-2026-1392: SR WP Minify HTML <= 2.1 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1392 affects the SR WP Minify HTML plugin (up to v2.1) with a medium severity CVSS score of 4.3. Unauthenticated attackers can exploit this cross-site request forgery vulnerability, so ensure to update to the patched version.
March 24, 2026
CVE-2026-1397: PQ Addons – Creative Elementor Widgets <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes PoC, Patch Analysis & Rule
CVE-2026-1397 affects the Peacefulqode Elementzplus Widgets plugin (v1.0.0) with a CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, impacting user security. Patching is essential.
March 24, 2026
CVE-2026-1647: Comment Genius <= 1.2.5 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2026-1647 affects the Comment Genius plugin (up to version 1.2.5) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential attacks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.