AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14130: Post Like Dislike <= 1.0 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2025-14130 affects the Post Like Dislike plugin for WordPress (version 1.0), exposing it to a medium severity reflected cross-site scripting vulnerability. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14121: EDD Download Info <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-14121 affects the EDD Download Info plugin (up to v1.1) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14128: Stumble! for WordPress <= 1.1.1 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2025-14128 affects the Stumble! for WordPress plugin (up to version 1.1.1) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2025-14131: WP Widget Changer <= 1.2.5 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2025-14131 affects the WP Widget Changer plugin (up to version 1.2.5) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability, so users should patch immediately.
March 18, 2026
CVE-2025-13694: AA Block country <= 1.0.1 Unauthenticated IP Address Spoofing via X-Forwarded-For Header PoC, Patch Analysis & Rule
CVE-2025-13694 affects the Aa Block Country plugin for WordPress (up to 1.0.1) with a medium severity (CVSS 5.3) IP address spoofing vulnerability. Ensure you update to the patched version to maintain access control integrity.
March 18, 2026
CVE-2025-13841: Smart App Banners <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13841 affects the Smart App Banners plugin (v1.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to the patched version to prevent potential script injection by authenticated attackers.
March 18, 2026
CVE-2025-13887: AI BotKit <= 1.1.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13887 affects Ai Botkit For Lead Generation plugin versions up to 1.1.7, with a CVSS score of 6.4. Update to version 1.1.8 to mitigate the stored XSS vulnerability that allows script injection by authenticated users.
March 18, 2026
CVE-2025-14460: Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 Missing Authorization to Unauthenticated Arbitrary Order Status Change PoC, Patch Analysis & Rule
CVE-2025-14460 affects Woo Payment Gateway For Piraeus Bank (up to version 3.1.4) with a CVSS score of 5.3. It allows unauthorized order status changes, risking significant business disruption. Patching is essential.
March 18, 2026
CVE-2025-14028: Contact Us Simple Form <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2025-14028 affects the Contact Us Simple Form plugin for WordPress, with a CVSS score of 4.4. Admins should patch to prevent stored XSS attacks that can compromise user sessions.
March 18, 2026
CVE-2025-13419: Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 Missing Authorization to Unauthenticated Media Deletion PoC, Patch Analysis & Rule
CVE-2025-13419 affects the Front Editor plugin for WordPress (up to 5.0.0) with a CVSS score of 5.3. Unauthenticated attackers can delete media via a REST API endpoint. Update to version 5.0.1 to mitigate this risk.
March 18, 2026
CVE-2025-14144: Mstoic Shortcodes <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14144 affects the Mstoic Shortcodes plugin (up to v2.0) with a CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, making patching essential to prevent script injection.
March 18, 2026
CVE-2025-14114: 1180px Shortcodes <= 1.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14114 affects the 1180px Shortcodes plugin (up to v1.1.1) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, impacting site security. Ensure you update to the patched version.
March 18, 2026
CVE-2025-13990: Mamurjor Employee Info <= 1.0.0 Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation PoC, Patch Analysis & Rule
CVE-2025-13990 affects the Mamurjor Employee Info plugin (v1.0.0) with a medium severity (CVSS 4.3) cross-site request forgery vulnerability. Ensure you patch to prevent unauthorized data manipulation by attackers.
March 18, 2026
CVE-2025-14110: WP Js List Pages Shortcodes <= 1.21 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14110 affects the WP Js List Pages Shortcodes plugin (up to v1.21) with a medium severity (CVSS 6.4) XSS vulnerability. Authenticated attackers can inject scripts, impacting user safety. Ensure you update to the patched version.
March 18, 2026
CVE-2025-13847: PhotoFade <= 0.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-13847 affects the PhotoFade plugin (up to v0.2.1) with a CVSS score of 6.4, exposing users to stored XSS attacks. Ensure to patch to the latest version to mitigate this risk.
March 18, 2026
CVE-2025-13667: WP Recipe Manager <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field PoC, Patch Analysis & Rule
CVE-2025-13667 affects the WP Recipe Manager plugin (v1.0.0) with a medium severity CVSS score of 6.4. Authenticated users can exploit stored XSS via the 'Skill Level' field. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14999: Latest Tabs <= 1.5 Cross-Site Request Forgery to Plugin's Settings Update PoC, Patch Analysis & Rule
CVE-2025-14999 affects the Kento Latest Tabs plugin (up to v1.5) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to prevent unauthorized changes by attackers.
March 18, 2026
CVE-2025-13531: Stylish Order Form Builder <= 1.0 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter PoC, Patch Analysis & Rule
CVE-2025-13531 reveals a medium severity XSS vulnerability in the Stylish Order Form Builder plugin for WordPress, affecting version 1.0. Patching is crucial as it allows authenticated attackers to inject malicious scripts.
March 18, 2026
CVE-2025-12540: ShareThis Dashboard for Google Analytics <= 3.2.4 Unauthenticated Google Analytics Data Exposure PoC, Patch Analysis & Rule
CVE-2025-12540 affects the Googleanalytics plugin (v3.2.4) with a medium severity (CVSS 4.7) vulnerability allowing remote code execution. Patch to secure OAuth credentials and prevent unauthorized access to Google Analytics data.
March 18, 2026
CVE-2025-13529: Unify <= 3.4.9 Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter PoC, Patch Analysis & Rule
CVE-2025-13529 affects the Unify WordPress plugin (up to version 3.4.9) with a medium severity CVSS score of 5.3. Unauthenticated attackers can delete plugin options; update to version 3.4.10 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.