AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
August 9, 2026
CVE-2026-65515: AffiliateWP <= 2.35.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-65515 affects AffiliateWP versions up to 2.35.0 with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts, impacting user security. Update to the latest version to mitigate risks.
August 9, 2026
CVE-2026-65504: BOX NOW Delivery Croatia <= 3.3.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65504 affects the Box Now Delivery Croatia plugin (up to version 3.3.0) with a medium severity CVSS score of 5.3. Ensure you patch to prevent unauthorized access due to missing capability checks.
August 9, 2026
CVE-2026-65552: Export User Data <= 2.2.6 Authenticated (Subscriber+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-65552 reveals a high severity PHP Object Injection vulnerability in the Export User Data plugin for WordPress, affecting versions up to 2.2.6. Authenticated attackers can exploit this flaw, so ensure you update to the patched...
August 9, 2026
CVE-2026-65541: Staff Training <= 1.0.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65541 affects the Staff Training plugin for WordPress (up to v1.0.7) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this vulnerability, so patching is essential to prevent unauthorized actions.
August 9, 2026
CVE-2026-65546: Qode Tours <= 3.1.3.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-65546 reveals a high-severity SQL injection vulnerability in the Qode Tours plugin for WordPress (up to version 3.1.3.1). Unauthenticated attackers can exploit this flaw to access sensitive database information. Ensure you...
August 9, 2026
CVE-2026-65543: Vimeo <= 1.2.2 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-65543 affects the Vimeo plugin for WordPress (up to 1.2.2), exposing sensitive data to authenticated users. With a CVSS score of 4.3, patching is essential to mitigate this medium severity vulnerability.
August 9, 2026
CVE-2026-65558: AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking <= 2.3.5 Unauthenticated Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-65558 affects AffiliateX plugin versions up to 2.3.5, with a CVSS score of 7.2. Unauthenticated SSRF allows attackers to make web requests. Update to version 2.3.6 to mitigate this vulnerability.
August 9, 2026
CVE-2026-65523: Formidable Forms Signature Online Contract Automation <= 2.0.1 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-65523 affects the Formidable Forms Signature plugin (up to v2.0.1) with a CVSS score of 5.3. Unauthenticated users can exploit this IDOR vulnerability, so update to v2.0.2 to mitigate risks.
August 9, 2026
CVE-2026-59557: Events Made Easy <= 3.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-59557 affects the Events Made Easy plugin for WordPress (up to version 3.1.3) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this vulnerability, so update to version 3.1.4 to mitigate risks.
August 9, 2026
CVE-2026-59553: Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-59553 affects the Best Woocommerce Feed plugin (versions 7.6.1 and earlier) with a CVSS score of 7.2. Users should upgrade to version 7.6.2 to mitigate the high severity stored XSS risk.
August 9, 2026
CVE-2026-59529: Ebook Store <= 6.19 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-59529 affects the Ebook Store plugin for WordPress (up to 6.19) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data, highlighting the need for immediate patching.
August 9, 2026
CVE-2026-65568: Visual Composer Website Builder <= 45.15.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-65568 affects the Visual Composer plugin for WordPress (up to 45.15.0) with a medium severity (CVSS 4.3). Ensure you update to version 45.16.0 to mitigate unauthorized access risks.
August 9, 2026
CVE-2026-59556: Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-59556 affects the Aco Woo Dynamic Pricing plugin (up to 4.5.11) with a high severity CVSS score of 7.2. Unauthenticated stored XSS can lead to script injection; users should patch immediately to mitigate risks.
August 9, 2026
CVE-2026-59532: Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.2 Unauthenticated Price Maniputlation PoC, Patch Analysis & Rule
CVE-2026-59532 affects the Booking And Rental Manager For Woocommerce plugin (up to v2.7.2), allowing unauthenticated price manipulation. With a CVSS score of 5.3, ensure you update to the patched version to mitigate this risk.
August 9, 2026
CVE-2026-65521: WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets <= 4.3.0 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-65521 affects the WP Social Reviews plugin (up to version 4.3.0) with a CVSS score of 5.3, allowing unauthenticated access to sensitive data. Update to version 4.3.1 to mitigate this risk.
August 9, 2026
CVE-2026-59527: MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-59527 affects the MapSVG Lite Interactive Vector Maps plugin for WordPress (up to 8.14.0) with a CVSS score of 7.5. Unauthenticated SQL injection can expose sensitive data; upgrade to 8.14.1 to mitigate.
August 8, 2026
CVE-2026-66701: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-66701 affects the Profile Builder plugin for WordPress (up to 3.16.5) due to a missing capability check, allowing unauthorized access. Update to version 3.16.6 to mitigate this medium severity vulnerability.
August 8, 2026
CVE-2026-66696: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.7.8 Authenticated (Contributor+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-66696 affects Kadence Blocks plugin (up to 3.7.8) with a medium severity (CVSS 4.3). Authenticated attackers can exploit it to access sensitive data. Update to version 3.7.8.1 to mitigate this risk.
August 8, 2026
CVE-2026-66692: Colissimo shipping methods for WooCommerce <= 2.10.0 Authenticated (Customer+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-66692 affects the Colissimo Shipping Methods for WooCommerce plugin (up to version 2.10.0) with a CVSS score of 4.3. Authenticated users can exploit this remote code execution vulnerability; upgrade to version 3.0.0 to mitigate.
August 8, 2026
CVE-2026-66699: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-66699 affects Dokan Lite plugin versions up to 5.0.10, allowing authenticated users to execute unauthorized actions. Update to 5.0.11 to mitigate this medium severity vulnerability with a CVSS score of 4.3.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.