AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14360: Blockons <= 1.2.15 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-14360 affects the Blockons plugin for WordPress (versions up to 1.2.15) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium-severity vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2025-48094: Magic Slider <= 2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-48094 affects the Magic Slider plugin for WordPress (up to version 2.2) with a medium severity CVSS score of 6.1 due to reflected XSS. Ensure to patch to mitigate risks from potential script injections.
March 18, 2026
CVE-2025-69169: Easy Media Download <= 1.1.11 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69169 affects the Easy Media Download plugin (up to v1.1.11) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure timely patching to mitigate risks.
March 18, 2026
CVE-2026-0675: NextGEN Download Gallery <= 1.6.2 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-0675 affects the NextGEN Download Gallery plugin for WordPress, allowing unauthenticated attackers to access sensitive data. Users should upgrade from version 1.6.2 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-27002: CountDown With Image or Video Background <= 1.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-27002 affects the Countdown With Background plugin (v1.5 and earlier) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the risk of reflected XSS attacks.
March 18, 2026
CVE-2025-23993: Felan Framework <= 1.1.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-23993 affects the Felan Framework plugin for WordPress (up to v1.1.3) with a high severity (CVSS 7.5) SQL injection vulnerability. Unauthenticated attackers can exploit this to access sensitive data; patching is essential.
March 18, 2026
CVE-2025-49043: Magic Responsive Slider and Carousel WordPress <= 1.6 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-49043 affects the Magic Carousel plugin (up to version 1.6) with a medium severity CVSS score of 6.1 due to reflected XSS. Ensure you update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2025-47666: Image&Video FullScreen Background <= 1.6.7 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-47666 affects the Lbg_fullscreen_fullwidth_slider plugin for WordPress (up to 1.6.7) with a CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 18, 2026
CVE-2025-27005: HTML5 Video Player <= 5.3.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-27005 affects the Lbg Vp2 Html5 Bottom plugin (up to version 5.3.5) with a medium severity CVSS score of 6.1. Users should patch to prevent XSS attacks that allow script injection through unsanitized inputs.
March 18, 2026
CVE-2025-32123: HTML5 Video Player with Playlist & Multiple Skins <= 5.3.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-32123 affects the Lbg Vp2 Html5 Rightside plugin (up to v5.3.5) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2025-13679: Tutor LMS <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details PoC, Patch Analysis & Rule
CVE-2025-13679 affects the Tutor LMS plugin (up to v3.9.3) with a CVSS score of 6.5. It allows unauthorized data access for authenticated users. Upgrade to v3.9.4 to mitigate exposure of sensitive PII.
March 18, 2026
CVE-2026-27094: Page Builder Gutenberg Blocks – CoBlocks <= 3.1.16 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-27094 affects the Coblocks plugin for WordPress (up to version 3.1.16) with a medium severity CVSS score of 6.4. Update to 3.1.17 to mitigate the stored XSS risk from authenticated attackers.
March 18, 2026
CVE-2025-12640: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 Missing Authorization to Authenticated (Author+) Media Replacement PoC, Patch Analysis & Rule
CVE-2025-12640 affects the Folders plugin for WordPress (up to version 3.1.5) with a medium severity (CVSS 4.3) vulnerability. Authenticated attackers can replace media files; update to version 3.1.6 to mitigate this risk.
March 18, 2026
CVE-2025-14275: Jeg Elementor Kit <= 3.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget PoC, Patch Analysis & Rule
CVE-2025-14275 affects the Jeg Elementor Kit plugin (up to v3.0.1) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to v3.0.2 to mitigate risks from authenticated attackers injecting malicious scripts.
March 18, 2026
CVE-2025-14984: Gutenverse Form <= 2.3.2 Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload PoC, Patch Analysis & Rule
CVE-2025-14984 affects the Gutenverse Form plugin (up to v2.3.2) with a medium severity (CVSS 6.4) XSS vulnerability. Update to v2.4.0 to mitigate risks from malicious SVG uploads.
March 18, 2026
CVE-2025-69351: Ninja Tables <= 5.2.4 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69351 affects the Ninja Tables plugin for WordPress (up to version 5.2.4) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to version 5.2.5 to mitigate potential data exposure risks.
March 18, 2026
CVE-2025-47500: Stackable <= 3.19.5 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-47500 affects the Stackable Ultimate Gutenberg Blocks plugin (up to v3.19.5) with a medium severity CVSS of 6.4. Patch to v3.19.6 to mitigate stored XSS risks from authenticated attackers.
March 18, 2026
CVE-2025-14358: REHub Framework <= 19.9.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-14358 affects the REHub Framework plugin for WordPress (up to version 19.9.5) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2026-22517: GA4WP: Google Analytics for WordPress <= 2.10.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22517 affects the GA4WP plugin (up to v2.10.0) with a CVSS score of 4.3. This medium severity vulnerability allows unauthorized actions by authenticated users. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-27092: WPAdverts – Classifieds Plugin <= 2.2.11 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-27092 affects the WPAdverts plugin (up to v2.2.11) with a medium severity (CVSS 4.3) vulnerability. Authenticated attackers can exploit this flaw for unauthorized actions. Upgrade to v2.3.0 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.