AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-23
CVE-2026-1075: ZT Captcha <= 1.0.4 – Cross-Site Request Forgery to Settings Update (zt-captcha)
The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce validation on the save_ztcpt_captcha_settings action where the nonce check can be bypassed by sending an empty token value. This makes it possible for unauthenticated attackers to modify the plugin's…
2026-01-23
CVE-2026-1257: Administrative Shortcodes <= 0.3.4 – Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute (administrative-shortcodes)
The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above,…
2026-01-23
CVE-2026-1099: Administrative Shortcodes <= 0.3.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes (administrative-shortcodes)
The Administrative Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'login' and 'logout' shortcode attributes in all versions up to, and including, 0.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that…
2026-01-23
CVE-2026-1076: Star Review Manager <= 1.2.2 – Cross-Site Request Forgery to Settings Update (star-review-manager)
The Star Review Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's CSS settings via a forged request granted they can trick a site…
2026-01-23
CVE-2025-14985: Alpha Blocks <= 1.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta (alpha-blocks)
The Alpha Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alpha_block_css’ parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever…
2026-01-23
CVE-2026-1070: Alex User Counter <= 6.0 – Cross-Site Request Forgery to Settings Update (user-counter)
The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the alex_user_counter_function() function. This makes it possible for unauthenticated attackers to update the plugin settings via a forged request granted they can trick a site administrator…
2026-01-23
CVE-2026-1081: Set Bulk Post Categories <= 1.1 – Cross-Site Request Forgery to Bulk Post Category Update (set-bulk-post-categories)
The Set Bulk Post Categories plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the bulk category update functionality. This makes it possible for unauthenticated attackers to modify post categories in bulk via a forged request granted they can…
2026-01-23
CVE-2025-14941: GZSEO <= 2.0.11 – Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting (gzseo)
The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the embed_code parameter. This makes it possible for authenticated attackers, with contributor…
2026-01-23
CVE-2026-1097: ThemeRuby Multi Authors <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes (themeruby-multi-authors)
The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to…
2026-01-23
CVE-2025-14843: Wizit Gateway for WooCommerce <= 1.2.9 – Missing Authentication to Unauthenticated Arbitrary Order Cancellation (wizit-gateway-for-woocommerce)
The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.2.9. This is due to a lack of authentication and authorization checks in the 'handle_checkout_redirecturl_response' function. This makes it possible for unauthenticated attackers to cancel arbitrary WooCommerce orders by sending a crafted request…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.