AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-23805: Media Search Enhanced <= 0.9.1 Authenticated (Author+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-23805 affects the Media Search Enhanced plugin (up to v0.9.1) with a medium severity SQL injection vulnerability (CVSS 6.5). Update to v0.9.2 to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2026-22492: Docket Cache <= 24.07.04 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22492 affects the Docket Cache plugin for WordPress (up to 24.07.04) with a medium severity CVSS score of 4.3. Ensure you update to version 24.07.05 to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-22486: Re Gallery – Responsive Photo Gallery <= 1.17.19 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22486 affects the Regallery plugin (up to v1.17.19) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability, so update to v1.17.20 to mitigate risks.
March 18, 2026
CVE-2025-69349: RSS Feed Widget <= 3.0.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69349 affects the RSS Feed Widget plugin for WordPress up to version 3.0.2, allowing unauthorized actions by authenticated users. Upgrade to version 3.0.3 to mitigate this medium severity vulnerability with a CVSS score of 4.3.
March 18, 2026
CVE-2025-69093: ShopMagic <= 4.7.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69093 affects the ShopMagic for WooCommerce plugin (up to version 4.7.2) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to version 4.7.3 to mitigate this risk.
March 18, 2026
CVE-2026-22522: Block Slider <= 2.2.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22522 affects the Block Slider plugin for WordPress (up to version 2.2.3) with a medium severity (CVSS 4.3) vulnerability. Ensure to patch to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-12551: ListingHub 1.2.6 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-12551 affects the ListingHub plugin for WordPress (up to 1.2.6) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows unauthenticated attackers to inject scripts, impacting user security. Patching is...
March 18, 2026
CVE-2026-22519: MediaPress <= 1.6.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-22519 affects the MediaPress plugin (v1.6.2 and below) with a medium severity CVSS of 6.4 due to stored XSS. Update to v1.6.3 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2026-22488: Dashboard Welcome for Beaver Builder <= 1.0.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22488 affects the Dashboard Welcome for Beaver Builder plugin (up to v1.0.8), allowing unauthorized access due to a missing capability check. Users should update to the patched version to mitigate this medium severity risk.
March 18, 2026
CVE-2026-22487: Speed Kit <= 2.0.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22487 affects the Baqend plugin for WordPress (up to version 2.0.2) with a medium severity CVSS score of 4.3. Ensure to patch this vulnerability to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2026-22490: Bulk Landing Page Creator for WordPress LPagery <= 2.4.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22490 affects the LPagery plugin for WordPress (up to version 2.4.9) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Update to version 2.4.10 to mitigate this risk.
March 18, 2026
CVE-2025-13504: Real Estate Pro <= 2.1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13504 affects the Real Estate Pro plugin for WordPress (up to version 2.1.4) with a medium severity CVSS score of 6.1. Ensure timely patching to mitigate reflected XSS risks.
March 18, 2026
CVE-2026-22518: X Addons for Elementor <= 1.0.23 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-22518 affects the X Addons Elementor plugin (up to version 1.0.23) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure you update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2025-69350: Accordion <= 3.0.3 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69350 affects the Accordions Wp plugin (up to version 3.0.3) with a medium severity CVSS score of 4.4. Users should upgrade to 3.0.4 to mitigate the stored XSS risk in multi-site setups.
March 18, 2026
CVE-2025-14077: Simcast <= 1.0.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2025-14077 affects the Simcast plugin for WordPress (version 1.0.0) with a medium severity CVSS score of 4.3. Unauthenticated attackers can exploit this CSRF vulnerability to modify settings, highlighting the need for prompt patching.
March 18, 2026
CVE-2026-22521: Handmade Framework <= 3.9 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-22521 affects the Handmade Framework plugin for WordPress (up to v3.9) with a high severity CVSS score of 7.5. Authenticated attackers can exploit this authentication bypass to execute arbitrary PHP code, necessitating...
March 18, 2026
CVE-2025-14053: Travel Bucket List <= 0.5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-14053 affects the Wish To Go plugin (up to v0.5.2) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Authenticated attackers can exploit this flaw, so ensure timely patching or consider WAF coverage.
March 18, 2026
CVE-2026-22489: Image Slider Slideshow <= 1.8 Authenticated (Contributor+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-22489 affects the Image Slider Slideshow plugin (up to version 1.8) with a medium severity CVSS score of 4.3. Authenticated users can exploit this IDOR vulnerability, so patching is essential to prevent unauthorized access.
March 18, 2026
CVE-2025-14109: AH Shortcodes <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14109 affects the AH Shortcodes plugin (up to 1.0.2) with a medium severity (CVSS 6.4) due to stored XSS vulnerabilities. Ensure you update to the patched version to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2025-14352: Awesome Hotel Booking <= 1.0.3 Incorrect Authorization to Unauthenticated Arbitrary Booking Modification PoC, Patch Analysis & Rule
CVE-2025-14352 affects the Awesome Hotel Booking plugin (up to v1.0.3) with a medium severity (CVSS 5.3) flaw allowing unauthorized data modification. Users should update to the patched version to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.