AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14867: Flashcard Plugin for WordPress <= 0.9 Authenticated (Contributor+) Arbitrary File Read via Path Traversal PoC, Patch Analysis & Rule
CVE-2025-14867 affects the Flashcard plugin for WordPress (up to version 0.9) with a medium severity (CVSS 6.5) path traversal vulnerability. Authenticated attackers can read sensitive files; patching is essential.
March 18, 2026
CVE-2025-14875: HBLPAY Payment Gateway for WooCommerce <= 5.0.0 Reflected Cross-Site Scripting via 'cusdata' Parameter PoC, Patch Analysis & Rule
CVE-2025-14875 affects the Hblpay Payment Gateway for WooCommerce plugin (up to version 5.0.0), with a medium severity CVSS score of 6.1. Ensure to patch to mitigate reflected XSS risks from the 'cusdata' parameter.
March 18, 2026
CVE-2025-13657: HelpDesk contact form plugin <= 1.1.5 Cross-Site Request Forgery to Settings Update via handle_query_args PoC, Patch Analysis & Rule
CVE-2025-13657 affects the Helpdesk Contact Form plugin (up to v1.1.5) with a medium severity (CVSS 4.3) Cross-Site Request Forgery vulnerability. Update to v1.1.6 to mitigate unauthorized configuration changes.
March 18, 2026
CVE-2025-14887: twinklesmtp – Email Service Provider For WordPress <= 1.03 Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings PoC, Patch Analysis & Rule
CVE-2025-14887 affects the Twinklesmtp plugin (up to version 1.03) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit stored XSS vulnerabilities, so ensure timely patching and review user permissions.
March 18, 2026
CVE-2025-14888: Simple User Meta Editor <= 1.0.0 Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field PoC, Patch Analysis & Rule
CVE-2025-14888 affects the Simple User Meta Editor plugin (v1.0.0) with a medium severity CVSS score of 4.4. Authenticated admins can exploit stored XSS; ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14845: NS IE Compatibility Fixer <= 2.1.5 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14845 affects the NS IE Compatibility Fixer plugin for WordPress (up to v2.1.5) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to prevent unauthorized settings changes.
March 18, 2026
CVE-2025-14842: Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 Unauthenticated Limited Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-14842 affects the Drag And Drop Multiple File Upload Contact Form 7 plugin (up to 1.3.9.2) with a CVSS score of 6.1. Update to 1.3.9.3 to mitigate the risk of unauthenticated file uploads that could lead to remote code execution.
March 18, 2026
CVE-2025-14901: Bit Form – Contact Form Plugin <= 2.21.6 Missing Authorization to Unauthenticated Workflow Replay PoC, Patch Analysis & Rule
CVE-2025-14901 affects the Bit Form plugin (up to v2.21.6) with a CVSS score of 6.5. It allows unauthorized workflow execution by unauthenticated attackers. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-14891: Customer Reviews for WooCommerce <= 5.93.1 Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter PoC, Patch Analysis & Rule
CVE-2025-14891 affects the Customer Reviews for WooCommerce plugin (up to 5.93.1) with a medium severity (CVSS 6.4) due to stored XSS. Update to version 5.94.0 to mitigate risks from potential script injections.
March 18, 2026
CVE-2025-14468: AMP for WP – Accelerated Mobile Pages <= 1.1.9 Cross-Site Request Forgery to Comment Submission PoC, Patch Analysis & Rule
CVE-2025-14468 affects the Accelerated Mobile Pages plugin (up to v1.1.9) with a medium severity CVSS score of 4.3. Patch to v1.1.10 to mitigate the CSRF vulnerability that allows unauthorized comment submissions.
March 18, 2026
CVE-2025-14835: WP Photo Album Plus <= 9.1.05.008 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-14835 affects the WP Photo Album Plus plugin (up to version 9.1.05.008) with a high severity CVSS score of 7.1 due to reflected XSS. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2025-14059: EmailKit <= 1.6.1 Authenticated (Author+) Arbitrary File Read via Path Traversal PoC, Patch Analysis & Rule
CVE-2025-14059 affects the EmailKit plugin for WordPress (up to 1.6.1) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit a file upload vulnerability to read sensitive files. Update to version 1.6.2 to mitigate.
March 18, 2026
CVE-2026-0656: iPaymu Payment Gateway for WooCommerce <= 2.0.2 Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure PoC, Patch Analysis & Rule
CVE-2026-0656 affects the iPaymu For WooCommerce plugin (up to v2.0.2) with a CVSS score of 8.2. This high-severity vulnerability allows remote code execution, exposing customer data. Update to v2.0.3 to mitigate risks.
March 18, 2026
CVE-2025-67931: BulletProof Security <= 6.9 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-67931 affects the Bulletproof Security plugin for WordPress, allowing unauthenticated access to sensitive data in versions up to 6.9. Upgrade to version 7.0 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-69348: The Events Calendar Countdown Addon <= 1.4.15 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69348 affects the Countdown For The Events Calendar plugin (up to v1.4.15) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v1.4.16 to mitigate.
March 18, 2026
CVE-2025-69092: Essential Addons for Elementor <= 6.5.3 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69092 affects the Essential Addons For Elementor Lite plugin (up to 6.5.3) with a CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so update to version 6.5.4 to mitigate risks.
March 18, 2026
CVE-2026-24634: Ultimate Reviews <= 3.2.16 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-24634 affects the Ultimate Reviews plugin (up to version 3.2.16) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this IDOR vulnerability to access restricted review content. Update to version...
March 18, 2026
CVE-2025-12648: WP-Members Membership Plugin <= 3.5.4.4 Unauthenticated Information Exposure via Unprotected Files PoC, Patch Analysis & Rule
CVE-2025-12648 affects the WP-Members plugin (up to 3.5.4.4) with a medium severity (CVSS 5.3) authentication bypass vulnerability. Update to 3.5.4.5 to mitigate unauthorized access to sensitive user files.
March 18, 2026
CVE-2026-22481: BD Courier Order Ratio Checker <= 2.0.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22481 affects the Bd Courier Order Ratio Checker plugin (up to v2.0.1) with a medium severity score of 4.3. Authenticated users can exploit this flaw for unauthorized actions. Ensure you update to the patched version.
March 18, 2026
CVE-2025-67933: Taskbuilder <= 4.0.9 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67933 affects the Taskbuilder plugin for WordPress (up to version 4.0.9) with a medium severity CVSS score of 6.1. Users should upgrade to version 5.0.0 to mitigate the reflected XSS vulnerability.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.