AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-15018: Optional Email <= 1.3.11 Unauthenticated Privilege Escalation to Account Takeover PoC, Patch Analysis & Rule
CVE-2025-15018 reveals a critical privilege escalation vulnerability in the Optional Email plugin for WordPress (up to 1.3.11). Unauthenticated attackers can reset user passwords, including for admins. Update to the patched version...
March 18, 2026
CVE-2025-15158: WP Enable WebP <= 1.0 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-15158 affects the WP Enable WebP plugin (version 1.0) with a CVSS score of 8.8, allowing authenticated attackers to upload arbitrary files. Patching is essential to mitigate potential remote code execution risks.
March 18, 2026
CVE-2025-15000: Page Keys <= 1.3.3 Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter PoC, Patch Analysis & Rule
CVE-2025-15000 affects the Page Keys plugin (up to v1.3.3) with a medium severity (CVSS 4.4) XSS vulnerability. Patch to v1.3.4 to mitigate risks of script injection on multisite installations.
March 18, 2026
CVE-2025-13521: WP Status Notifier <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2025-13521 affects the WP Change Status Notifier plugin (version 1.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized settings changes.
March 18, 2026
CVE-2025-12030: ACF to REST API <= 3.3.4 Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification PoC, Patch Analysis & Rule
CVE-2025-12030 affects the ACF to REST API plugin (up to v3.3.4) with a CVSS score of 4.3. Authenticated users can modify ACF fields on unauthorized posts. Update to the patched version to mitigate this vulnerability.
March 18, 2026
CVE-2025-13527: xShare <= 1.0.1 Cross-Site Request Forgery to 'rs_plugin_reset' Parameter PoC, Patch Analysis & Rule
CVE-2025-13527 affects the xShare plugin for WordPress (up to version 1.0.1) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you patch to prevent unauthorized settings resets by tricking admins into actions.
March 18, 2026
CVE-2025-13519: SVG Map Plugin <= 1.0.0 Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13519 affects the SVG Map By Saedi plugin for WordPress (up to 1.0.0) with a CVSS score of 6.1. Unauthenticated attackers can exploit this CSRF vulnerability to manipulate settings and inject scripts. Patching is essential.
March 18, 2026
CVE-2025-13493: Latest Registered Users <= 1.4 Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export PoC, Patch Analysis & Rule
CVE-2025-13493 affects the Latest Registered Users plugin for WordPress (up to v1.4), allowing unauthorized data export of user details. This high-severity vulnerability (CVSS 7.5) requires immediate patching to mitigate risks.
March 18, 2026
CVE-2025-13520: MTCaptcha WordPress Plugin <= 2.7.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2025-13520 affects the MTCaptcha WordPress plugin (up to version 2.7.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to protect against unauthorized settings changes.
March 18, 2026
CVE-2025-13496: Moosend Landing Pages <= 1.1.6 Missing Authorization to Authenticated (Subscriber+) Option Deletion PoC, Patch Analysis & Rule
CVE-2025-13496 affects the Moosend Landing Pages plugin (up to v1.1.6) with a medium severity (CVSS 5.3) vulnerability. Authenticated users can delete critical API keys. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-11877: User Activity Log <= 2.2 Unauthenticated Limited Options Update via Failed Login PoC, Patch Analysis & Rule
CVE-2025-11877 affects the User Activity Log plugin (v2.2) with a high severity CVSS score of 7.5. Unauthenticated attackers can exploit this vulnerability to modify critical site options. Patching is essential to secure your WordPress...
March 18, 2026
CVE-2025-13497: Recras WordPress plugin <= 6.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-13497 affects the Recras WordPress plugin (up to version 6.4.1) with a medium severity (CVSS 6.4) XSS vulnerability. Update to 6.4.2 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2025-12958: Rankology SEO and Analytics Tool <= 2.0 Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation PoC, Patch Analysis & Rule
CVE-2025-12958 affects the Rankology SEO and Analytics Tool plugin (up to version 2.0) with a low severity (CVSS 2.7). Authenticated users can modify data; update to version 2.5 to mitigate this risk.
March 18, 2026
CVE-2025-14802: LearnPress – WordPress LMS Plugin <= 4.3.2.2 Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion PoC, Patch Analysis & Rule
CVE-2025-14802 affects LearnPress versions up to 4.3.2.1, allowing authenticated attackers to delete lesson materials due to a parameter mismatch. Upgrade to 4.3.2.2 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-12449: aBlocks – WordPress Gutenberg Blocks <= 2.4.0 Missing Authorization to Authenticated (Subscriber+) Settings Modification PoC, Patch Analysis & Rule
CVE-2025-12449 affects the aBlocks WordPress plugin (up to v2.4.0) with a medium severity (CVSS 5.4) vulnerability allowing authenticated users to access sensitive settings. Upgrade to v2.4.1 to mitigate this risk.
March 18, 2026
CVE-2025-14792: Key Figures <= 1.1 Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render PoC, Patch Analysis & Rule
CVE-2025-14792 affects the Key Figures plugin for WordPress (up to version 1.1) with a medium severity CVSS score of 4.4 due to stored XSS. Admins should patch to mitigate the risk of script injection on multi-site installations.
March 18, 2026
CVE-2025-13369: Premmerce WooCommerce Customers Manager <= 1.1.14 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-13369 affects the Woo Customers Manager plugin (up to v1.1.14) with a CVSS score of 6.1. This medium-severity XSS vulnerability requires user interaction to exploit. Update to v1.1.15 to mitigate risks.
March 18, 2026
CVE-2025-13371: Money Space <= 2.13.9 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-13371 affects the Money Space plugin (versions
March 18, 2026
CVE-2025-14904: Newsletter Email Subscribe <= 2.4 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14904 affects the Newsletter Email Subscribe plugin for WordPress (up to v2.4) with a medium severity (CVSS 4.3) CSRF vulnerability. Patching is essential to prevent unauthorized settings changes via user interaction.
March 18, 2026
CVE-2025-14370: Quote Comments <= 3.0.0 Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14370 affects the Quote Comments plugin for WordPress (up to version 3.0.0) with a medium severity (CVSS 5.3). Authenticated users can modify settings due to missing authorization checks. Update to the patched version to...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.