AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14718: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 Missing Authorization to Authenticated (Contributor+) Workflow Manipulation PoC, Patch Analysis & Rule
CVE-2025-14718 affects the Post Expirator plugin (up to v4.9.3) with a medium severity (CVSS 5.4) authentication bypass. Update to v4.9.4 to prevent unauthorized actions by users with Contributor-level access.
March 18, 2026
CVE-2025-14436: Brevo for WooCommerce <= 4.0.49 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-14436 affects the WooCommerce Sendinblue Newsletter Subscription plugin (v4.0.49 and below) with a high severity CVSS score of 7.2 due to stored XSS. Upgrade to v4.0.50 to mitigate this vulnerability.
March 18, 2026
CVE-2025-14720: Booking for Appointments and Events Calendar – Amelia <= 1.2.38 Missing Authorization to Unauthenticated Multiple AJAX Actions PoC, Patch Analysis & Rule
CVE-2025-14720 affects the Amelia booking plugin (up to v1.2.38) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity vulnerability to perform unauthorized actions. Update to v2.0 to mitigate risks.
March 18, 2026
CVE-2025-14574: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-14574 affects the weDocs plugin for WordPress (up to version 2.1.15) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data via the REST API. Update to version 2.1.16 to mitigate this risk.
March 18, 2026
CVE-2026-24358: Quiz And Survey Master <= 10.3.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24358 affects Quiz Master Next plugin versions up to 10.3.3, allowing unauthorized access for authenticated users. Update to version 10.3.4 to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2026-24353: User Registration <= 4.4.9 Authenticated (Subscriber+) Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2026-24353 affects the User Registration plugin (up to v4.4.9) with a medium severity (CVSS 5.4) vulnerability allowing authenticated users to execute arbitrary shortcodes. Upgrade to v5.0 to mitigate risks.
March 18, 2026
CVE-2025-66533: GiveWP <= 4.13.1 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2025-66533 affects the GiveWP plugin (up to version 4.13.1) with a medium severity (CVSS 6.5) vulnerability allowing unauthenticated shortcode execution. Update to version 4.13.2 to mitigate this risk.
March 18, 2026
CVE-2025-22715: Attractive Donations System Easy Stripe & Paypal donations <= 1.25 Missing Authorization to Unauthenticated Arbitrary Content Deletion PoC, Patch Analysis & Rule
CVE-2025-22715 affects the WP Attractive Donations System plugin (versions
March 18, 2026
CVE-2026-27090: Kenta Companion <= 1.3.3 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-27090 affects the Kenta Companion plugin for WordPress (up to version 1.3.3) with a medium severity CVSS score of 4.3. Ensure proper nonce validation to mitigate unauthorized actions via CSRF.
March 18, 2026
CVE-2025-22726: nK Themes Helper <= 1.7.9 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-22726 affects the nK Themes Helper plugin (up to 1.7.9) with a medium severity (CVSS 6.4) Server-Side Request Forgery vulnerability. Authenticated users can exploit this flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2026-24387: WP Quick Post Duplicator <= 2.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24387 affects the WP Quick Post Duplicator plugin (up to version 2.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized post duplication. Upgrade to version 2.2 to mitigate this risk.
March 18, 2026
CVE-2025-22728: Workreap (theme’s plugin) <= 3.3.6 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-22728 affects the Workreap plugin for WordPress (up to v3.3.6) with a medium severity CVSS of 6.5. Authenticated users can exploit this SQL injection vulnerability to access sensitive database information. Patching is essential.
March 18, 2026
CVE-2025-49055: Lead Capturing Pages <= 2.5 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-49055 affects the Wp Lead Capture plugin (v2.5) with a CVSS score of 7.5. This high-severity SQL injection allows unauthenticated attackers to access sensitive data. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-50005: tagDiv Composer <= 5.4.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-50005 affects the Td Composer plugin for WordPress (up to version 5.4.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, so ensure you update to the patched version.
March 18, 2026
CVE-2025-22725: Virtual Assistant <= 3.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-22725 affects the Virtual Assistant plugin for WordPress (up to version 3.0) with a high severity CVSS score of 7.2. Users should patch to mitigate the risk of stored cross-site scripting attacks.
March 18, 2026
CVE-2025-49045: Super Interactive Maps <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-49045 affects the Super Interactive Maps plugin (up to version 2.3) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the risk of cross-site scripting attacks.
March 18, 2026
CVE-2025-27004: Famous Responsive Image And Video Grid Gallery WordPress <= 1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-27004 affects the Famous Grid Image and Video Gallery plugin (up to version 1.4) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 18, 2026
CVE-2025-22713: WooCommerce Orders & Customers Exporter <= 5.4 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-22713 affects the WooCommerce Orders & Customers Exporter plugin (up to v5.4) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated attackers can exploit this flaw to extract sensitive database...
March 18, 2026
CVE-2025-14975: Custom Login Page Customizer <= 2.5.3 Unauthenticated Privilege Escalation via Password Reset PoC, Patch Analysis & Rule
CVE-2025-14975 affects the Login Customizer plugin (v2.5.3) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this vulnerability to reset user passwords. Update to v2.5.4 to mitigate this risk.
March 18, 2026
CVE-2026-0674: Campaign Monitor for WordPress <= 2.9.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-0674 affects the Forms For Campaign Monitor plugin (up to v2.9.0) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this flaw to perform unauthorized actions. Patching is recommended.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.