AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69354: Better Business Reviews <= 0.1.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69354 affects the Better Business Reviews plugin (up to v0.1.1) with a medium severity (CVSS 4.3) vulnerability. Patch to v0.1.2 to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2026-24366: YITH WooCommerce Request A Quote <= 2.46.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24366 affects the YITH WooCommerce Request A Quote plugin (up to v2.46.0) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw for unauthorized actions. Update to v2.46.1 to mitigate risks.
March 18, 2026
CVE-2025-14172: WP Page Permalink Extension <= 1.5.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush PoC, Patch Analysis & Rule
CVE-2025-14172 affects the Change WP Page Permalinks plugin (up to v1.5.4) with a medium severity (CVSS 6.5) vulnerability. Authenticated users can exploit this to flush rewrite rules, so ensure you update to the patched version.
March 18, 2026
CVE-2025-13701: Shabat Keeper <= 0.4.4 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2025-13701 affects the Shabat Keeper plugin for WordPress (up to version 0.4.4) with a CVSS score of 6.1. This reflected XSS vulnerability allows attackers to inject scripts, emphasizing the need for immediate patching.
March 18, 2026
CVE-2025-13903: PullQuote <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13903 affects the Pullquote plugin for WordPress (version 1.0) with a CVSS score of 6.4. This medium severity XSS vulnerability allows authenticated users to inject scripts. Ensure you update to the patched version to mitigate...
March 18, 2026
CVE-2025-13967: Woodpecker for WordPress <= 3.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-13967 affects the Woodpecker plugin (up to v3.0.4) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, impacting site security. Ensure you update to the patched version.
March 18, 2026
CVE-2025-14555: Countdown Timer Widget Countdown <= 2.7.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-14555 affects the Widget Countdown plugin (up to v2.7.7) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities; update to v2.7.8 to mitigate risks.
March 18, 2026
CVE-2025-14506: ConvertForce Popup Builder <= 0.0.7 Stored Cross-Site Scripting via entrance_animation PoC, Patch Analysis & Rule
CVE-2025-14506 affects the ConvertForce Popup Builder plugin (up to v0.0.7) with a CVSS score of 6.4. Authenticated attackers can exploit a stored XSS vulnerability. Update to v0.0.8 to mitigate this risk.
March 18, 2026
CVE-2025-13704: Autogen Headers Menu <= 1.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter PoC, Patch Analysis & Rule
CVE-2025-13704 affects the Autogen Headers Menu plugin for WordPress (versions up to 1.0.1) with a CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so patching is essential.
March 18, 2026
CVE-2025-13893: Lesson Plan Book <= 1.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13893 affects the Lesson Plan Book plugin for WordPress (up to v1.3) with a medium severity CVSS score of 6.1. Ensure you patch to mitigate reflected XSS risks from unauthenticated attackers.
March 18, 2026
CVE-2025-13854: Curved Text <= 0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13854 affects the Curved Text plugin for WordPress (version 0.1) with a medium severity (CVSS 6.4) due to stored XSS vulnerabilities. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-13897: Client Testimonial Slider <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field PoC, Patch Analysis & Rule
CVE-2025-13897 affects the Wp Client Testimonial plugin (up to v2.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Patch to mitigate risks from authenticated attackers injecting scripts in admin pages.
March 18, 2026
CVE-2025-13717: Contact Form vCard Generator <= 2.4 Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter PoC, Patch Analysis & Rule
CVE-2025-13717 affects the Contact Form vCard Generator plugin (up to v2.4) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data. Ensure you patch to mitigate this risk.
March 18, 2026
CVE-2025-13892: MG AdvancedOptions <= 1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13892 affects the MG AdvancedOptions plugin for WordPress, with a medium severity CVSS score of 6.1. Users should update from version 1.2 to mitigate reflected XSS risks.
March 18, 2026
CVE-2025-13895: Top Position Google Finance <= 0.1.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13895 affects the Top Position Google Finance plugin (v0.1.0) with a medium severity CVSS score of 6.1. Users should patch to prevent reflected XSS attacks that could compromise user data.
March 18, 2026
CVE-2025-13900: WP Popup Magic <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-13900 affects the WP Popup Magic plugin (v1.0.0) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-13908: The Tooltip <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13908 affects The Tooltip plugin for WordPress (up to v1.0.2) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Patching is essential.
March 18, 2026
CVE-2025-13852: Debt.com Business in a Box <= 4.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13852 affects the Debtcom Business In A Box plugin (up to v4.1.0) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-13862: Menu Card <= 0.8.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13862 affects the Menu Card plugin for WordPress (up to version 0.8.0) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, making patching essential to protect user data.
March 18, 2026
CVE-2025-13853: Nearby Now Reviews <= 5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13853 affects the Nearby Now Reviews plugin (up to v5.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to the patched version to mitigate risks from authenticated attacks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.