AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-66140: Uper for Elementor <= 1.0.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66140 affects the Uper Elementor plugin (v1.0.5) with a medium severity score of 4.3. It allows authenticated users to perform unauthorized actions. Ensure you update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-69360: TheGem Theme Elements (for WPBakery) <= 5.11.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69360 affects TheGem Elements plugin (up to v5.11.0) with a Medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS. Ensure you patch to mitigate risks.
March 18, 2026
CVE-2025-69356: TheGem Theme Elements (for Elementor) <= 5.11.0 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-69356 affects TheGem Elements for Elementor (up to v5.11.0) with a CVSS score of 7.5. This high-severity vulnerability allows authenticated attackers to bypass access controls and execute arbitrary PHP code. Patching is essential.
March 18, 2026
CVE-2025-69357: TheGem Theme Elements (for Elementor) <= 5.11.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69357 affects TheGem Elements for Elementor plugin (up to v5.11.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure to patch to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2026-24384: Merge + Minify + Refresh <= 2.14 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24384 affects the Merge Minify Refresh plugin for WordPress, with a medium severity CVSS score of 4.3. Users should upgrade to version 2.15 to mitigate the Cross-Site Request Forgery risk.
March 18, 2026
CVE-2026-0831: Templately <= 3.4.8 Unauthenticated Limited Arbitrary JSON File Write PoC, Patch Analysis & Rule
CVE-2026-0831 affects the Templately plugin for WordPress (versions
March 18, 2026
CVE-2025-14976: User Registration & Membership <= 4.4.8 Cross-Site Request Forgery to Arbitrary Post Deletion PoC, Patch Analysis & Rule
CVE-2025-14976 affects the User Registration plugin (up to v4.4.8) with a medium severity CVSS score of 5.4. Ensure you update to v4.4.9 to mitigate the risk of unauthorized post deletions via CSRF attacks.
March 18, 2026
CVE-2026-24633: Add Expires Headers & Optimized Minify <= 3.1.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24633 affects the Add Expires Headers plugin (up to v3.1.0) with a CVSS score of 5.3. Unauthenticated attackers can exploit a missing capability check, making it crucial to patch or mitigate this vulnerability.
March 18, 2026
CVE-2026-24629: Web Accessibility with Max Access <= 2.1.0 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24629 affects the Accessibility Toolbar plugin for WordPress (up to version 2.1.0) with a medium severity CVSS score of 4.4. Admins should patch to prevent stored XSS attacks that can affect multi-site installations.
March 18, 2026
CVE-2026-24630: Stylish Cost Calculator <= 8.1.9 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24630 affects the Stylish Cost Calculator plugin (up to v8.1.9) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to v8.2.1 to mitigate risks from authenticated attacks.
March 18, 2026
CVE-2025-14943: Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-14943 affects the Blog2Social plugin (up to v8.7.2) with a CVSS score of 4.3. Authenticated users can access sensitive content from protected posts. Upgrade to v8.7.3 to mitigate this vulnerability.
March 18, 2026
CVE-2026-24632: Delay Redirects <= 1.0.0 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24632 affects the Delay Redirects plugin for WordPress (v1.0.0) with a CVSS score of 4.4. Authenticated attackers can exploit this stored XSS vulnerability in multisite setups, highlighting the need for immediate patching.
March 18, 2026
CVE-2026-27074: Shortcoder — Create Shortcodes for Anything <= 6.5.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27074 affects the Shortcoder plugin (up to version 6.5.1) with a medium severity CVSS of 6.4. Authenticated users can exploit this stored XSS vulnerability, highlighting the need to update to version 6.5.2.
March 18, 2026
CVE-2025-69353: Proxy & VPN Blocker <= 3.5.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69353 affects the Proxy Vpn Blocker plugin (up to 3.5.3) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this vulnerability to gain unauthorized access, so update to version 3.5.4.
March 18, 2026
CVE-2025-12379: Shortcodes and extra features for Phlox theme <= 2.17.13 Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget PoC, Patch Analysis & Rule
CVE-2025-12379 affects the Auxin Elements plugin (up to version 2.17.13) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so users should upgrade to version 2.17.14.
March 18, 2026
CVE-2025-69355: Tickera <= 3.5.6.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69355 affects the Tickera Event Ticketing System plugin (up to v3.5.6.4) with a medium severity (CVSS 4.3) vulnerability. Patch to v3.5.6.5 to prevent unauthorized access by authenticated users.
March 18, 2026
CVE-2025-13393: Featured Image from URL (FIFU) <= 5.3.1 Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' PoC, Patch Analysis & Rule
CVE-2025-13393 affects the Featured Image From URL plugin (up to v5.3.1) with a medium severity (CVSS 4.3). Authenticated users can exploit SSRF vulnerabilities. Update to v5.3.2 to mitigate risks.
March 18, 2026
CVE-2026-24965: Contest Gallery <= 28.1.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24965 affects the Contest Gallery plugin (up to version 28.1.1) with a CVSS score of 4.3. It allows authenticated users to perform unauthorized actions. Update to the patched version to mitigate this vulnerability.
March 18, 2026
CVE-2025-69352: The Events Calendar <= 6.15.12.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69352 affects The Events Calendar plugin (up to version 6.15.12.2) with a medium severity CVSS score of 4.3. Authenticated users can exploit a missing capability check, so update to version 6.15.13 to mitigate risks.
March 18, 2026
CVE-2025-14948: miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 Missing Authorization to Unauthenticated Notification Settings Modification PoC, Patch Analysis & Rule
CVE-2025-14948 affects the miniOrange Sms Order Notification OTP Verification plugin (up to v4.3.8) with a CVSS score of 5.3. Unauthenticated attackers can modify SMS settings; update to v4.3.9 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.