AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-24606: Bayarcash WooCommerce <= 4.3.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24606 affects the Bayarcash WooCommerce plugin (up to version 4.3.12) with a medium severity score of 5.3. Unauthenticated attackers can exploit this remote code execution vulnerability, so patching is essential.
March 23, 2026
CVE-2026-0734: WP Allowed Hosts <= 1.0.8 Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter PoC, Patch Analysis & Rule
CVE-2026-0734 affects the WP Allowed Hosts plugin (v1.0.8) with a medium severity (CVSS 4.4) stored XSS vulnerability. Admins should patch to prevent script injection risks on multi-site installations.
March 23, 2026
CVE-2025-14770: Shipping Rate By Cities <= 2.0.0 Unauthenticated SQL Injection via 'city' Parameter PoC, Patch Analysis & Rule
CVE-2025-14770 affects the Shipping Rate By Cities plugin (up to v2.0.0) with a CVSS score of 7.5, exposing users to SQL injection risks. Upgrade to v2.0.1 to mitigate potential data breaches.
March 23, 2026
CVE-2025-15376: Stopwords for comments <= 1.1 Missing Authorization to Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-15376 affects the Stopwords For Comments plugin for WordPress (up to v1.1) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to patch to prevent unauthorized modifications by attackers.
March 23, 2026
CVE-2025-15512: Aplazo Payment Gateway <= 1.4.3 Missing Authorization to Unauthenticated Order Status Manipulation PoC, Patch Analysis & Rule
CVE-2025-15512 affects the Aplazo Payment Gateway plugin for WordPress (up to 1.4.3) with a CVSS score of 5.3. Unauthenticated attackers can manipulate WooCommerce order statuses. Upgrade to version 1.5.0 to mitigate this risk.
March 23, 2026
CVE-2026-0813: Short Link <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page PoC, Patch Analysis & Rule
CVE-2026-0813 affects the Short Link plugin (v1.0) with a medium severity (CVSS 4.4) Stored XSS vulnerability. Admins should patch to prevent script injection risks on affected pages.
March 23, 2026
CVE-2025-15475: PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
CVE-2025-15475 affects the Payhere Payment Gateway Plugin (up to v2.3.9) with a CVSS score of 5.3. This medium severity vulnerability allows unauthorized order status modifications. Upgrade to v2.4.0 to mitigate risks.
March 23, 2026
CVE-2025-14173: Perfit WooCommerce <= 1.0.1 Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion PoC, Patch Analysis & Rule
CVE-2025-14173 affects the Perfit WooCommerce plugin (v1.0.1 and earlier) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated attackers to delete settings. Update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-2421: ilGhera Carta Docente for WooCommerce <= 1.5.0 Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter PoC, Patch Analysis & Rule
CVE-2026-2421 affects the WC Carta Docente plugin for WordPress, with a medium severity CVSS score of 6.5. Authenticated attackers can exploit a file upload vulnerability to delete critical files. Ensure timely patching to mitigate risks.
March 23, 2026
CVE-2026-2432: CM Custom Reports <= 1.2.7 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels PoC, Patch Analysis & Rule
CVE-2026-2432 affects the CM Custom Reports plugin for WordPress, with a medium severity score of 4.4. Authenticated attackers can exploit stored XSS vulnerabilities, impacting multi-site installations. Immediate patching is recommended.
March 23, 2026
CVE-2026-4136: Membership Plugin – Restrict Content <= 3.2.24 Unvalidated Redirect in Password Reset Flow via rcp_redirect PoC, Patch Analysis & Rule
CVE-2026-4136 affects the Restrict Content plugin for WordPress, with a medium severity score of 4.3. Users should update to the latest version to mitigate risks from unvalidated redirects that could lead to phishing attacks.
March 23, 2026
CVE-2025-15363: Get Use APIs – JSON Content Importer < 2.0.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15363 affects the Json Content Importer plugin for WordPress, with a medium severity CVSS score of 6.4. Users should update to the latest version to mitigate the risk of stored cross-site scripting attacks.
March 23, 2026
CVE-2026-3658: Appointment Booking Calendar <= 1.6.10.0 Unauthenticated SQL Injection via 'fields' Parameter PoC, Patch Analysis & Rule
CVE-2026-3658 affects the Simply Schedule Appointments plugin for WordPress with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows attackers to access sensitive data. Users should update to the latest version to...
March 23, 2026
CVE-2026-2571: Download Manager <= 3.3.49 Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter PoC, Patch Analysis & Rule
CVE-2026-2571 affects the Download Manager plugin for WordPress, allowing authenticated users to access sensitive data. Users should update to version 3.3.50 or later to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-3475: Instant Popup Builder <= 1.1.7 Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter PoC, Patch Analysis & Rule
CVE-2026-3475 affects the Instant Popup Builder plugin for WordPress, allowing unauthenticated remote code execution with a CVSS score of 5.3. Users should update to the patched version to mitigate this vulnerability.
March 23, 2026
CVE-2026-3550: RockPress <= 1.0.17 Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions PoC, Patch Analysis & Rule
CVE-2026-3550 affects the Ft Rockpress plugin for WordPress, with a medium severity rating of 5.3. Authenticated users can exploit this vulnerability for remote code execution. Ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-25455: Product Slider, Product Grid, Product Masonry <= 1.13.60 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25455 affects the WooCommerce Products Slider plugin (up to 1.13.60) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-25465: CP Multi View Events Calendar <= 1.4.34 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25465 affects the CP Multi View Calendar plugin for WordPress, with a medium severity CVSS score of 6.4. Users should update to the latest version to mitigate stored cross-site scripting risks.
March 23, 2026
CVE-2026-25452: Remoji – Post/Comment Reaction and Enhancement <= 2.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25452 affects the Remoji plugin for WordPress, with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts, impacting user security. Ensure you update to the latest version to...
March 23, 2026
CVE-2026-4006: Draft List <= 2.6.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter PoC, Patch Analysis & Rule
CVE-2026-4006 affects the Simple Draft List plugin for WordPress, with a CVSS score of 6.4. Authenticated attackers can exploit stored XSS due to insufficient input sanitization. Users should update to the latest version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.