AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-22483: teachPress <= 9.0.12 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-22483 affects the Teachpress plugin (up to version 9.0.12) with a medium severity CVSS score of 4.3 due to a CSRF vulnerability. Ensure proper nonce validation to mitigate unauthorized actions.
March 18, 2026
CVE-2026-22482: IMGspider <= 2.3.12 Authenticated (Contributor+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-22482 affects the Imgspider plugin for WordPress (up to version 2.3.12) with a medium severity (CVSS 6.4) SSRF vulnerability. Authenticated users can exploit this to access internal services, highlighting the need for immediate...
March 18, 2026
CVE-2025-69346: AffiliateX <= 1.3.9.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69346 affects the AffiliateX plugin for WordPress (up to version 1.3.9.3) with a medium severity CVSS score of 4.3. Users should update to version 1.4.0 to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-22472: Easy Form Builder <= 3.9.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22472 affects the Easy Form Builder plugin (up to version 3.9.6) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit this flaw for unauthorized actions. Update to version 4.0.0 to mitigate risks.
March 18, 2026
CVE-2025-67932: Listeo Core < 2.0.19 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67932 affects the Listeo Core plugin for WordPress (up to version 2.0.19) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure you update to the patched version to mitigate potential exploits.
March 18, 2026
CVE-2026-22470: FireStorm Professional Real Estate <= 2.7.11 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-22470 affects the Fs Real Estate Plugin (up to 2.7.11) with a medium severity (CVSS 4.9) SQL injection vulnerability. Authenticated attackers can exploit this flaw, emphasizing the need for immediate patching.
March 18, 2026
CVE-2026-24635: EduBlink Core <= 2.0.7 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-24635 affects the EduBlink Core plugin (up to v2.0.7) with a CVSS score of 7.5. This high-severity vulnerability allows authenticated attackers to bypass access controls and execute arbitrary PHP code. Patching is essential.
March 18, 2026
CVE-2025-14552: MediaPress <= 1.6.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode PoC, Patch Analysis & Rule
CVE-2025-14552 affects the MediaPress plugin (up to v1.6.1) with a medium severity (CVSS 6.4) XSS vulnerability. Users should update to v1.6.2 to mitigate risks from authenticated attacks exploiting insufficient input sanitization.
March 18, 2026
CVE-2025-9318: Quiz and Survey Master (QSM) <= 10.3.1 Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter PoC, Patch Analysis & Rule
CVE-2025-9318 affects the Quiz Master Next plugin (up to 10.3.1) with a medium severity (CVSS 6.5) SQL injection vulnerability. Users should upgrade to version 10.3.2 to mitigate potential data exposure risks.
March 18, 2026
CVE-2025-9294: Quiz And Survey Master <= 10.3.1 Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion PoC, Patch Analysis & Rule
CVE-2025-9294 affects the Quiz Master Next plugin (up to version 10.3.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized deletion of quiz results. Update to version 10.3.2 to mitigate this risk.
March 18, 2026
CVE-2025-67930: eHive Search <= 2.5.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67930 affects the eHive Search plugin for WordPress (up to version 2.5.0), exposing users to reflected XSS attacks. Upgrade to version 2.5.1 to mitigate this medium severity vulnerability with a CVSS score of 6.1.
March 18, 2026
CVE-2025-14371: TaxoPress <= 3.41.0 Missing Authorization to Authenticated (Contributor+) Arbitrary Post Tag Modification PoC, Patch Analysis & Rule
CVE-2025-14371 affects the Simple Tags plugin (up to v3.41.0) with a medium severity (CVSS 4.3). Authenticated users can modify post taxonomy terms. Update to v3.42.0 to mitigate this vulnerability.
March 18, 2026
CVE-2025-5919: Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 Missing Authorization to Unauthenticated Booking Details View And Modification PoC, Patch Analysis & Rule
CVE-2025-5919 affects the Timetics plugin for WordPress (up to 1.0.36) with a medium severity (CVSS 6.5) vulnerability allowing unauthorized access to booking details. Update to version 1.0.37 to mitigate this risk.
March 18, 2026
CVE-2025-13215: Shortcodes and extra features for Phlox theme <= 2.17.13 Unauthenticated Draft Posts Information Exposure PoC, Patch Analysis & Rule
CVE-2025-13215 affects Auxin Elements plugin (up to v2.17.13) with a medium severity (CVSS 5.3) vulnerability. Unauthenticated attackers can access draft post titles. Update to v2.17.14 to mitigate this risk.
March 18, 2026
CVE-2025-9637: Quiz and Survey Master (QSM) <= 10.3.1 Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads PoC, Patch Analysis & Rule
CVE-2025-9637 affects the Quiz Master Next plugin (up to v10.3.1) with a medium severity CVSS score of 6.5. Unauthenticated attackers can access private quizzes and upload files. Update to v10.3.2 to mitigate this risk.
March 18, 2026
CVE-2025-12067: Table Field Add-on for ACF and SCF <= 1.3.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content PoC, Patch Analysis & Rule
CVE-2025-12067 affects the Advanced Custom Fields Table Field plugin (up to 1.3.30) with a medium severity CVSS score of 6.4. Patch to version 1.3.31 to mitigate the risk of stored XSS attacks by authenticated users.
March 18, 2026
CVE-2025-13766: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion PoC, Patch Analysis & Rule
CVE-2025-13766 affects the MasterStudy LMS plugin (up to v3.7.6) with a CVSS score of 5.4. It allows authenticated users to modify or delete data. Upgrade to v3.7.7 to mitigate this vulnerability.
March 18, 2026
CVE-2025-13812: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 Missing Authorization to Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-13812 affects GamiPress plugin version 7.6.1, allowing authenticated users to access sensitive data due to a missing capability check. Upgrade to version 7.6.2 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-15001: FS Registration Password <= 1.0.1 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
CVE-2025-15001 affects the FS Registration Password plugin (up to v1.0.1) with a critical CVSS score of 9.8. Unauthenticated attackers can reset user passwords, including admins. Upgrade to v2.0.1 to mitigate this risk.
March 18, 2026
CVE-2025-13964: LearnPress – WordPress LMS Plugin <= 4.3.2 Missing Authentication to Unauthenticated Course Modification PoC, Patch Analysis & Rule
CVE-2025-13964 affects the LearnPress plugin (up to version 4.3.2) with a medium severity CVSS score of 5.3. Unauthenticated attackers can modify course content; update to version 4.3.2.1 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.