AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14146: Booking Calendar <= 10.14.10 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-14146 affects the Booking Calendar plugin (up to v10.14.10) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive booking data. Upgrade to v10.14.11 to mitigate this vulnerability.
March 18, 2026
CVE-2025-13729: Entry Views <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-13729 affects the Entry Views plugin for WordPress (v1.0.0) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so patching is essential.
March 18, 2026
CVE-2025-13753: WP Table Builder <= 2.0.19 Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation PoC, Patch Analysis & Rule
CVE-2025-13753 affects WP Table Builder plugin versions up to 2.0.19, allowing unauthorized data modification by authenticated users. Upgrade to version 2.0.20 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-14937: Frontend Admin by DynamiApps <= 3.28.23 Unauthenticated Stored Cross-Site Scripting via 'update_field' PoC, Patch Analysis & Rule
CVE-2025-14937 affects the Acf Frontend Form Element plugin (up to version 3.28.23) with a CVSS score of 7.2 due to a stored XSS vulnerability. Upgrade to version 3.28.24 to mitigate the risk of script injection attacks.
March 18, 2026
CVE-2025-13935: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion PoC, Patch Analysis & Rule
CVE-2025-13935 affects Tutor LMS plugin versions up to 3.9.2, allowing authenticated users to mark courses as completed without verification. Upgrade to version 3.9.4 to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2026-0627: AMP for WP <= 1.1.10 Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload PoC, Patch Analysis & Rule
CVE-2026-0627 affects the Accelerated Mobile Pages plugin (up to version 1.1.10) with a medium severity CVSS of 6.4. Users should update to version 1.1.11 to mitigate the stored XSS risk from SVG file uploads.
March 18, 2026
CVE-2025-14657: Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' PoC, Patch Analysis & Rule
CVE-2025-14657 affects the Wp Event Solution plugin (versions ≤4.0.51) with a CVSS score of 7.2. Unauthenticated attackers can exploit this high-severity XSS vulnerability to modify settings. Update to version 4.0.52 to mitigate risks.
March 18, 2026
CVE-2025-14741: Frontend Admin by DynamiApps <= 3.28.25 Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element PoC, Patch Analysis & Rule
CVE-2025-14741 affects the ACF Frontend Form Element plugin (up to version 3.28.25) with a critical CVSS score of 9.1. Unauthenticated attackers can delete arbitrary content. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-13628: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification PoC, Patch Analysis & Rule
CVE-2025-13628 affects Tutor plugin version 3.9.3, allowing authenticated users to delete coupons due to a missing capability check. Upgrade to version 3.9.4 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-14980: BetterDocs <= 4.3.3 Authenticated (Contributor+) Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-14980 affects the BetterDocs plugin for WordPress (up to version 4.3.3) with a CVSS score of 6.5. Authenticated users can access sensitive data. Upgrade to version 4.3.4 to mitigate this vulnerability.
March 18, 2026
CVE-2025-15057: SlimStat Analytics <= 5.3.3 Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter PoC, Patch Analysis & Rule
CVE-2025-15057 affects the Wp Slimstat plugin (up to v5.3.3) with a high severity CVSS score of 7.2. Unauthenticated attackers can exploit stored XSS. Update to v5.3.4 to mitigate this risk.
March 18, 2026
CVE-2026-0563: WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0563 affects the WP Google Street View plugin (up to v1.1.8) with a medium severity CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so update to v1.1.9 to mitigate risks.
March 18, 2026
CVE-2025-13934: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass PoC, Patch Analysis & Rule
CVE-2025-13934 affects the Tutor LMS plugin (up to version 3.9.3) allowing unauthorized course enrollment. Patch to version 3.9.4 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-15019: BIALTY Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15019 affects the Bulk Image Alt Text With Yoast plugin (up to 2.2.1) with a CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, so ensure you update to the patched version.
March 18, 2026
CVE-2025-15055: SlimStat Analytics <= 5.3.4 Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters PoC, Patch Analysis & Rule
CVE-2025-15055 affects the Wp Slimstat plugin (up to version 5.3.4) with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts, impacting site integrity. Update to version 5.3.5 to mitigate.
March 18, 2026
CVE-2025-14782: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 Missing Authorization to Authenticated (Forminator User+) CSV Export PoC, Patch Analysis & Rule
CVE-2025-14782 affects the Forminator plugin for WordPress (up to v1.49.1) with a medium severity (CVSS 5.3) authentication bypass. Update to v1.49.2 to mitigate unauthorized data export risks.
March 18, 2026
CVE-2025-14893: IndieWeb <= 4.0.5 Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter PoC, Patch Analysis & Rule
CVE-2025-14893 affects the IndieWeb plugin (up to 4.0.5) with a medium severity CVSS score of 6.4 due to stored XSS. Update to version 5.0.0 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2025-14736: Frontend Admin by DynamiApps <= 3.28.29 Unauthenticated Privilege Escalation to Administrator via Role Form Field PoC, Patch Analysis & Rule
CVE-2025-14736 affects the ACF Frontend Form Element plugin (up to 3.28.29) with a critical CVSS score of 9.8. Unauthenticated attackers can gain admin access via a user registration form; update to 3.28.30 to mitigate.
March 18, 2026
CVE-2025-14886: Japanized for WooCommerce <= 2.7.17 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
CVE-2025-14886 affects the Woocommerce For Japan plugin (up to version 2.7.17) with a medium severity CVSS score of 5.3. Patch to version 2.8.0 to prevent unauthorized order modifications via the REST API.
March 18, 2026
CVE-2025-13749: Clearfy <= 2.4.0 Cross-Site Request Forgery to Update Notification Tampering PoC, Patch Analysis & Rule
CVE-2025-13749 affects the Clearfy plugin (up to v2.4.0) with a medium severity CVSS score of 4.3. Unauthenticated attackers can disable update notifications via CSRF. Upgrade to v2.4.1 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.