AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-13722: Fluent Forms <= 6.1.7 Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder PoC, Patch Analysis & Rule
CVE-2025-13722 affects the Fluent Forms plugin (up to v6.1.7) with a medium severity (CVSS 5.3) vulnerability. Authenticated users can exploit missing authorization to create arbitrary forms. Upgrade to v6.1.8 to mitigate this risk.
March 18, 2026
CVE-2025-14112: Snillrik Restaurant <= 2.3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14112 affects the Snillrik Restaurant Menu plugin (up to 2.3.0) with a medium severity CVSS of 6.4. Authenticated users can exploit this stored XSS vulnerability, making it crucial to update to version 2.3.1.
March 18, 2026
CVE-2025-14127: Testimonial Master <= 0.2.1 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2025-14127 affects the Testimonial Master plugin (up to version 0.2.1) with a medium severity CVSS score of 6.1 due to reflected XSS vulnerabilities. Users should patch to mitigate potential script injection risks.
March 18, 2026
CVE-2025-13849: Cool YT Player <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13849 affects the Cool YT Player plugin (v1.0) with a medium severity (CVSS 6.4) due to stored XSS vulnerabilities. Users should patch immediately to prevent authenticated attacks that can inject harmful scripts.
March 18, 2026
CVE-2025-13974: Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content PoC, Patch Analysis & Rule
CVE-2025-13974 affects the Email Customizer for WooCommerce plugin (up to v2.6.7) with a medium severity CVSS score of 4.4. Admins should upgrade to v2.6.8 to mitigate the stored XSS risk in email templates.
March 18, 2026
CVE-2025-14453: My Album Gallery <= 1.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14453 affects the My Album Gallery plugin (up to 1.0.4) with a medium severity CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, making timely patching essential for security.
March 18, 2026
CVE-2025-14796: My Album Gallery <= 1.0.4 Authenticated (Author+) Stored Cross-Site Scripting via Image Title PoC, Patch Analysis & Rule
CVE-2025-14796 affects the My Album Gallery plugin (up to v1.0.4) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, so ensure to update to the patched version for protection.
March 18, 2026
CVE-2025-13418: Responsive Pricing Table <= 5.1.12 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13418 affects the Dk Pricr Responsive Pricing Table plugin (up to 5.1.12) with a medium severity CVSS score of 6.4. Authenticated users can exploit a stored XSS vulnerability; update to 5.1.13 to mitigate risks.
March 18, 2026
CVE-2025-15058: Responsive Pricing Table <= 5.1.12 Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency' PoC, Patch Analysis & Rule
CVE-2025-15058 affects the Dk Pricr Responsive Pricing Table plugin (up to v5.1.12) with a medium severity CVSS score of 6.4. Patch to v5.1.13 to mitigate the stored XSS risk from authenticated users.
March 18, 2026
CVE-2025-14122: AD Sliding FAQ <= 2.4 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-14122 affects the Ad Sliding FAQ plugin (up to v2.4) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Ensure you update to the patched version.
March 18, 2026
CVE-2025-14145: Niche Hero | Beautifully-designed blocks in seconds <= 1.0.5 Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14145 affects the Niche Hero plugin (up to 1.0.5) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, impacting site security. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14113: Viitor Button Shortcodes <= 3.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14113 affects the Viitor Shortcodes plugin (v3.0.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14057: Multi-column Tag Map <= 17.0.39 Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter PoC, Patch Analysis & Rule
CVE-2025-14057 affects the Multi Column Tag Map plugin (up to 17.0.39) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit this stored XSS vulnerability, making timely patching essential.
March 18, 2026
CVE-2025-14626: QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-14626 affects the Qr Code Tag For Wc From Goaskle Com plugin (up to v1.9.42) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-13848: STM Gallery 1.9 <= 0.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13848 affects the STM Gallery plugin (up to v0.9) with a medium severity (CVSS 6.4) due to stored XSS vulnerabilities. Users should update to the patched version to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2025-14465: Sticky Action Buttons <= 1.1 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14465 affects the Sticky Action Buttons plugin for WordPress (up to v1.1) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized settings changes.
March 18, 2026
CVE-2025-14118: Starred Review <= 1.4.2 Reflected Cross-Site Scripting via PHP_SELF Variable PoC, Patch Analysis & Rule
CVE-2025-14118 affects the Starred Review plugin for WordPress (up to version 1.4.2) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected XSS risks.
March 18, 2026
CVE-2025-14070: Reviewify <= 1.0.7 Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation PoC, Patch Analysis & Rule
CVE-2025-14070 reveals a high-severity vulnerability in the Review For Discount plugin (up to 1.0.7) allowing authenticated users to create unauthorized WooCommerce discount coupons. Update to version 1.0.8 to mitigate this risk.
March 18, 2026
CVE-2025-14147: Easy GitHub Gist Shortcodes <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14147 affects the Easy Github Gist Shortcodes plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2025-13801: Yoco Payments <= 3.9.0 Unauthenticated Arbitrary File Read PoC, Patch Analysis & Rule
CVE-2025-13801 affects the Yoco Payment Gateway plugin (up to version 3.9.0) with a high severity CVSS score of 7.5. Unauthenticated attackers can exploit a path traversal vulnerability to read sensitive files. Update to version 3.9.1...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.