AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 24, 2026
CVE-2026-1854: Post Flagger <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute PoC, Patch Analysis & Rule
The Post Flagger plugin for WordPress (up to version 1.1) has a medium severity XSS vulnerability (CVE-2026-1854). Authenticated attackers can inject scripts, impacting user safety. Ensure you update to the patched version.
March 23, 2026
CVE-2025-13910: WP-WebAuthn <= 1.3.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13910 affects the WP-WebAuthn plugin (up to v1.3.4) with a medium severity CVSS score of 6.1. Unauthenticated XSS can occur via the wwa_auth AJAX endpoint; ensure logging is disabled or update to the patched version.
March 23, 2026
CVE-2026-2290: Post Affiliate Pro <= 1.28.0 Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field PoC, Patch Analysis & Rule
CVE-2026-2290 affects the Post Affiliate Pro plugin for WordPress (up to 1.28.0) with a CVSS score of 6.5. Authenticated attackers can exploit this SSRF vulnerability, so ensure you patch to mitigate risks.
March 23, 2026
CVE-2026-0609: Logo Slider <= 4.9.0 Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0609 affects the Logo Slider Wp plugin (up to 4.9.0) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this Stored XSS vulnerability, making it crucial to patch or mitigate.
March 23, 2026
CVE-2026-1247: Survey <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2026-1247 affects the Survey plugin for WordPress (up to version 1.1) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit this stored XSS vulnerability, so patching is essential.
March 23, 2026
CVE-2026-1275: Multi Post Carousel by Category <= 1.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1275 affects the Multi Post Carousel plugin for WordPress (up to v1.4) with a CVSS score of 6.4. It allows authenticated attackers to exploit stored XSS vulnerabilities. Ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-1278: Mandatory Field <= 1.6.8 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields PoC, Patch Analysis & Rule
CVE-2026-1278 affects the Mandatory Fields plugin for WordPress (up to v1.6.8) with a CVSS score of 4.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure timely patching and review admin settings.
March 23, 2026
CVE-2026-1093: WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1093 affects the WPFAQBlock plugin (up to v1.1) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated users can exploit this flaw to inject scripts, making timely patching essential for security.
March 23, 2026
CVE-2025-14078: PAYGENT for WooCommerce <= 2.4.6 Missing Authorization to Unauthenticated Payment Callback Manipulation PoC, Patch Analysis & Rule
CVE-2025-14078 affects the WooCommerce For Paygent Payment Main plugin (up to v2.4.6) with a CVSS score of 5.3. Unauthenticated attackers can manipulate payment callbacks, so update to v2.4.7 to mitigate this risk.
March 23, 2026
CVE-2026-0725: Integrate Dynamics 365 CRM <= 1.1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration PoC, Patch Analysis & Rule
CVE-2026-0725 affects the Integrate Dynamics 365 CRM plugin (v1.1.1) with a medium severity CVSS score of 4.4 due to stored XSS. Upgrade to v1.1.2 to mitigate risks from authenticated attacks.
March 23, 2026
CVE-2026-24589: Cargus <= 1.5.8 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24589 affects the Cargus plugin for WordPress (up to version 1.5.8) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data, highlighting the need for immediate patching.
March 23, 2026
CVE-2026-0808: Spin Wheel <= 2.1.0 Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter PoC, Patch Analysis & Rule
CVE-2026-0808 affects the Spin Wheel plugin for WordPress (up to v2.1.0) with a medium severity (CVSS 5.3) vulnerability. Upgrade to v2.1.1 to mitigate the risk of unauthorized prize manipulation.
March 23, 2026
CVE-2025-12129: CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2025-12129 affects the CubeWP Framework plugin (up to 1.1.27) with a medium severity (CVSS 5.3) vulnerability that exposes sensitive post data. Update to version 1.1.28 to mitigate this information exposure risk.
March 23, 2026
CVE-2025-12168: Phrase TMS Integration for WordPress <= 4.7.5 Missing Authorization to Authenticated (Subscriber+) Log Deletion PoC, Patch Analysis & Rule
CVE-2025-12168 affects the Memsource Connector plugin (up to v4.7.5) with a CVSS score of 4.3. It allows authenticated users to delete log files due to missing capability checks. Update to v4.7.6 to mitigate this risk.
March 23, 2026
CVE-2025-14029: Community Events <= 1.5.6 Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter PoC, Patch Analysis & Rule
CVE-2025-14029 affects the Community Events plugin (up to v1.5.6) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized event approvals. Update to v1.5.7 to mitigate this risk.
March 23, 2026
CVE-2026-0833: Team Section Block <= 2.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link PoC, Patch Analysis & Rule
CVE-2026-0833 affects the Team Section Block plugin for WordPress (up to 2.0.0) with a CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so update to version 2.0.1 to mitigate risks.
March 23, 2026
CVE-2025-8615: CubeWP <= 1.1.26 Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode PoC, Patch Analysis & Rule
CVE-2025-8615 affects the CubeWP Framework plugin (up to v1.1.26) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to v1.1.27 to mitigate the risk of script injection by authenticated attackers.
March 23, 2026
CVE-2025-13725: Gutenberg Thim Blocks <= 1.0.1 Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter PoC, Patch Analysis & Rule
CVE-2025-13725 affects the Thim Blocks plugin for WordPress (up to 1.0.1) with a medium severity (CVSS 6.5) file upload vulnerability. Update to version 1.0.2 to mitigate the risk of unauthorized file access.
March 23, 2026
CVE-2025-14463: Payment Button for PayPal <= 1.2.3.41 Missing Authorization to Unauthenticated Arbitrary Order Creation PoC, Patch Analysis & Rule
CVE-2025-14463 affects the Wp Paypal plugin (up to v1.2.3.41) with a CVSS score of 5.3. Unauthenticated attackers can create arbitrary orders. Update to v1.2.3.42 to mitigate this vulnerability.
March 23, 2026
CVE-2026-0820: RepairBuddy <= 4.1116 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders PoC, Patch Analysis & Rule
CVE-2026-0820 affects the Computer Repair Shop plugin (up to v4.1116) with a medium severity (CVSS 5.3) vulnerability. Patch to v4.1125 to prevent unauthorized order modifications by authenticated users.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.