AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-4120: Info Cards <= 2.0.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes PoC, Patch Analysis & Rule
CVE-2026-4120 affects the Info Cards plugin for WordPress, with a medium severity CVSS score of 6.4. Users should patch to the latest version to mitigate the risk of stored cross-site scripting attacks.
March 23, 2026
CVE-2026-25461: Listeo-Core Directory Plugin by Purethemes <= 2.0.21 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25461 affects the Listeo Core plugin for WordPress, with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected cross-site scripting vulnerability, emphasizing the need for immediate patching.
March 23, 2026
CVE-2026-4068: Add Custom Fields to Media <= 2.0.3 Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter PoC, Patch Analysis & Rule
CVE-2026-4068 affects the Add Custom Fields to Media plugin for WordPress, with a medium severity score of 4.3. It allows unauthenticated attackers to delete custom media fields. Users should update to version 2.0.4 to mitigate this risk.
March 23, 2026
CVE-2026-32583: Modern Events Calendar <= 7.29.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32583 affects the Modern Events Calendar plugin for WordPress, allowing unauthorized access due to a missing capability check. Update to version 7.29.1 or later to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-25456: Automated FedEx live/manual rates with shipping labels – HPOS supported <= 5.1.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25456 affects the A2z Fedex Shipping plugin (up to version 5.1.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-1238: SlimStat Analytics <= 5.3.5 Unauthenticated Stored Cross-Site Scripting via 'fh' PoC, Patch Analysis & Rule
CVE-2026-1238 affects the WP SlimStat plugin with a high severity score of 7.2. It allows unauthenticated attackers to execute scripts via stored XSS. Update to version 5.3.6 or implement WAF for protection.
March 23, 2026
CVE-2026-32462: Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32462 affects the Master Addons plugin for WordPress, with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, highlighting the need for immediate patching or mitigation.
March 23, 2026
CVE-2026-32461: Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-32461 affects the Really Simple SSL plugin for WordPress, allowing unauthorized access for authenticated users. Users should update to version 9.5.8 or above to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-4038: Aimogen Pro <= 2.7.5 Unauthenticated Privilege Escalation via Arbitrary Function Call PoC, Patch Analysis & Rule
CVE-2026-4038 affects the Aimogen Pro plugin for WordPress, with a critical CVSS score of 9.8. Unauthenticated attackers can escalate privileges. Users should patch to version 2.7.6 or later to mitigate this risk.
March 23, 2026
CVE-2025-15520: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-15520 affects the Custom Registration Form Builder With Submission Manager plugin, allowing sensitive data exposure for authenticated users. Update to the latest version to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-27070: Everest Forms Pro <= 1.9.10 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27070 affects the Everest Forms Pro plugin for WordPress, with a high severity rating of 7.2. Users should update to the latest version to mitigate the risk of stored cross-site scripting attacks.
March 23, 2026
CVE-2026-1867: Guest posting / Frontend Posting / Front Editor – WP Front User Submit < 5.0.6 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-1867 affects the Front Editor plugin for WordPress, with a medium severity score of 5.3. Unauthenticated attackers can access sensitive data in versions up to 5.0.6. Patching is essential to mitigate this risk.
March 23, 2026
CVE-2026-2687: Reading progressbar < 1.3.1 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-2687 reveals a medium severity cross-site scripting vulnerability in the Reading Progress Bar plugin for WordPress. Patching is essential for affected multi-site installations to prevent script injection by authenticated attackers.
March 23, 2026
CVE-2026-25369: Flexmls® IDX Plugin <= 3.15.9 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25369 affects the Flexmls IDX plugin for WordPress with a medium severity (CVSS 6.1) cross-site scripting vulnerability. Users should update to the latest version to mitigate potential attacks.
March 23, 2026
CVE-2026-24968: Xagio SEO – AI Powered SEO <= 7.1.0.30 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-24968 affects the Xagio SEO plugin for WordPress, allowing unauthenticated attackers to escalate privileges to admin. Users should patch to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2026-32460: Ultra Addons for Contact Form 7 <= 3.5.36 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-32460 affects the Ultimate Addons For Contact Form 7 plugin with a medium severity (CVSS 6.4) due to stored cross-site scripting. Users should update to the patched version to mitigate potential attacks.
March 23, 2026
CVE-2026-32458: WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.7 Authenticated (Editor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32458 affects the Bulk Editor plugin for WordPress, with a medium severity score of 4.9. Authenticated attackers can exploit SQL injection vulnerabilities, so ensure you update to the patched version to mitigate risks.
March 23, 2026
CVE-2026-24373: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-24373 affects the Custom Registration Form Builder With Submission Manager plugin with a critical CVSS score of 9.8, allowing unauthenticated attackers to bypass authentication. Update to the latest version to mitigate risks.
March 23, 2026
CVE-2026-32459: UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 Authenticated (Shop manager+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-32459 affects the Checkout Upsell And Order Bumps plugin with a medium severity (CVSS 4.9) SQL injection vulnerability. Ensure you update to the patched version to protect against potential data breaches.
March 23, 2026
CVE-2026-24611: MetForm Pro <= 3.9.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24611 affects the Metform Pro plugin for WordPress, allowing unauthorized access due to a missing capability check. Users should patch to mitigate potential risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.