AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-15
CVE-2025-68015: Event Tickets with Ticket Scanner <= 2.8.5 – Unauthenticated Remote Code Execution (event-tickets-with-ticket-scanner)
The Event Tickets with Ticket Scanner plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.8.5. This makes it possible for unauthenticated attackers to execute code on the server.
2026-01-15
CVE-2025-13859: AffiliateX 1.0.0 – 1.3.9.3 – Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings (affiliatex)
The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_customization_settings AJAX action in versions 1.0.0 to 1.3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store arbitrary JavaScript that executes whenever an AffiliateX block renders…
2026-01-15
CVE-2026-0913: User Submitted Posts <= 20260110 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode (user-submitted-posts)
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'usp_access' shortcode in all versions up to, and including, 20260110 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,…
2026-01-15
CVE-2025-12641: Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 – Missing Authorization to Unauthenticated Role Demotion (awesome-support)
The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas_do_mr_activate_user' function not verifying that a user has permission to modify other users' roles, combined with a nonce reuse vulnerability where…
2026-01-15
CVE-2026-24599: NextMove Lite <= 2.23.0 – Unauthenticated Insecure Direct Object Reference (woo-thank-you-page-nextmove-lite)
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.23.0 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-01-15
CVE-2025-13062: Supreme Modules Lite <= 2.5.62 – Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass (supreme-modules-for-divi)
The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.5.62. This is due to insufficient file type validation detecting JSON files, allowing double extension files to bypass sanitization while being accepted as a valid JSON file. This makes it possible for authenticated attackers, with…
2026-01-15
CVE-2025-15370: Shield Security <= 21.0.9 – Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator (wp-simple-firewall)
The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable…
2026-01-15
CVE-2025-68003: Shown Connector <= 1.2.10 – Missing Authorization to Unauthenticated Settings Update (shown-connector)
The Shown Connector plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.10. This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-01-15
CVE-2025-14384: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 – Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure (all-in-one-seo-pack)
The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/aioseo/v1/ai/credits` REST route in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access…
2026-01-15
CVE-2025-14982: Booking Calendar <= 10.14.11 – Missing Authorization to Sensitive Information Exposure (booking)
The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.