AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1042: WP Hello Bar <= 1.02 Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-1042 in Wp Hello Bar (CVSS 4.4): WP Hello Bar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14351: Custom Fonts – Host Your Fonts Locally <= 2.1.16 Missing Authorization to Unauthenticated Font Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-14351 in Custom Fonts (CVSS 5.3): Custom Fonts – Host Your Fonts Locally. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.17.
March 18, 2026
CVE-2025-14348: weMail <= 2.0.7 Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure PoC, Patch Analysis & Rule
Medium CVE-2025-14348 in Wemail (CVSS 5.3): weMail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.8.
March 18, 2026
CVE-2025-14533: Advanced Custom Fields: Extended <= 0.9.2.1 Unauthenticated Privilege Escalation via Insert User Form Action PoC, Patch Analysis & Rule
Critical CVE-2025-14533 in Acf Extended (CVSS 9.8): Advanced Custom Fields: Extended. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.9.2.2.
March 18, 2026
CVE-2026-1045: Viet contact <= 1.3.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-1045 in Viet Contact (CVSS 4.4): Viet contact. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14978: PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14978 in Peachpay For Woocommerce (CVSS 5.3): PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net). Atomic Edge summarizes impact, exploitability, and patch details...
March 18, 2026
CVE-2025-14977: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure PoC, Patch Analysis & Rule
High CVE-2025-14977 in Dokan Lite (CVSS 8.1): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2026-1051: Newsletter – Send awesome emails from WordPress <= 9.1.0 Cross-Site Request Forgery to Newsletter Unsubscription PoC, Patch Analysis & Rule
Medium CVE-2026-1051 in Newsletter (CVSS 4.3): Newsletter – Send awesome emails from WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.1.1.
March 18, 2026
CVE-2025-69313: PostX <= 5.0.3 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69313 in Ultimate Post (CVSS 5.3): PostX. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.4.
March 18, 2026
CVE-2025-14798: LearnPress – WordPress LMS Plugin <= 4.3.2.4 Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API PoC, Patch Analysis & Rule
Medium CVE-2025-14798 in Learnpress (CVSS 5.3): LearnPress – WordPress LMS Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.2.5.
March 18, 2026
CVE-2025-69312: Xpro Elementor Addons <= 1.4.19.1 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2025-69312 in Xpro Elementor Addons (CVSS 8.8): Xpro Elementor Addons. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-69311: Broadstreet Ads <= 1.52.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69311 in Broadstreet (CVSS 4.3): Broadstreet Ads. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.52.2.
March 18, 2026
CVE-2025-67943: My auctions allegro <= 3.6.32 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-67943 in My Auctions Allegro Free Edition (CVSS 7.2): My auctions allegro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.33.
March 18, 2026
CVE-2026-24580: Ecwid Shopping Cart <= 7.0.5 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24580 in Ecwid Shopping Cart (CVSS 4.3): Ecwid Shopping Cart. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.0.6.
March 18, 2026
CVE-2026-24581: Points and Rewards for WooCommerce <= 2.9.5 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24581 in Points And Rewards For Woocommerce (CVSS 4.3): Points and Rewards for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.9.6.
March 18, 2026
CVE-2025-15466: Image Photo Gallery Final Tiles Grid <= 3.6.9 Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management PoC, Patch Analysis & Rule
Medium CVE-2025-15466 in Final Tiles Grid Gallery Lite (CVSS 5.4): Image Photo Gallery Final Tiles Grid. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.10.
March 18, 2026
CVE-2025-68019: SEO Booster <= 6.1.8 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-68019 in Seo Booster (CVSS 5.3): SEO Booster. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-25453: Advanced iFrame <= 2025.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-25453 in Advanced Iframe (CVSS 6.4): Advanced iFrame. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2026.0.
March 18, 2026
CVE-2025-68004: My Post Order <= 1.2.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-68004 in My Posts Order (CVSS 6.1): My Post Order. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-68894: ShoutOut <= 4.0.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-68894 in Shoutout (CVSS 6.1): ShoutOut. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.