AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14438: Xagio SEO <= 7.1.0.30 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-14438 affects the Xagio SEO plugin (up to v7.1.0.30) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this SSRF vulnerability, so update to v7.1.0.31 to mitigate risks.
March 18, 2026
CVE-2025-14997: BuddyPress Xprofile Custom Field Types <= 1.2.8 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-14997 affects the BuddyPress Xprofile Custom Field Types plugin (v1.2.8) with a high severity (CVSS 7.2) file upload vulnerability. Upgrade to v1.3.0 to mitigate risks of arbitrary file deletion by authenticated users.
March 18, 2026
CVE-2025-14996: AS Password Field In Default Registration Form <= 2.0.0 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
CVE-2025-14996 affects the AS Password Field In Default Registration Form plugin for WordPress, allowing unauthenticated attackers to escalate privileges and change passwords. Update to the patched version to mitigate this critical...
March 18, 2026
CVE-2025-14120: URL Image Importer <= 1.0.7 Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload PoC, Patch Analysis & Rule
CVE-2025-14120 affects the Url Image Importer plugin (up to v1.0.7) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to v1.0.8 to mitigate risks from authenticated attackers exploiting SVG file uploads.
March 18, 2026
CVE-2025-13652: CBX Bookmark & Favorite <= 2.0.4 Authenticated (Subscriber+) SQL Injection via `orderby` Parameter PoC, Patch Analysis & Rule
CVE-2025-13652 affects the CBX Bookmark & Favorite plugin (up to v2.0.4) with a medium severity SQL injection vulnerability (CVSS 6.5). Users should upgrade to v2.0.5 to mitigate risks of data exposure.
March 18, 2026
CVE-2026-0604: FastDup <= 2.7 Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter PoC, Patch Analysis & Rule
CVE-2026-0604 affects the FastDup plugin (up to version 2.7) with a CVSS score of 6.5. Authenticated attackers can exploit a path traversal vulnerability to access sensitive directories. Patching is essential.
March 18, 2026
CVE-2025-14034: ilGhera Support System for WooCommerce <= 1.2.6 Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion PoC, Patch Analysis & Rule
CVE-2025-14034 affects the Wc Support System plugin for WordPress (up to 1.2.6) with a CVSS of 5.3. Authenticated attackers can exploit this medium-severity vulnerability to delete support tickets. Upgrade to 1.2.7 to mitigate.
March 18, 2026
CVE-2025-11723: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-11723 affects the Simply Schedule Appointments plugin (up to version 1.6.9.5) with a CVSS score of 6.5. Unauthenticated attackers can exploit this vulnerability to access and modify booking data. Patching is essential.
March 18, 2026
CVE-2025-14441: Popupkit <= 2.2.0 Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion PoC, Patch Analysis & Rule
CVE-2025-14441 affects the Popup Builder Block plugin (up to v2.2.0) with a medium severity (CVSS 5.3) vulnerability allowing authenticated users to delete subscriber data. Update to v2.2.1 to mitigate this risk.
March 18, 2026
CVE-2025-11370: Depicter <= 4.0.7 Missing Authorization to Unauthenticated Display Rule Updates PoC, Patch Analysis & Rule
CVE-2025-11370 affects the Depicter plugin (up to 4.0.7) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized data modification. Update to version 4.7.0 to mitigate this risk.
March 18, 2026
CVE-2025-14153: Page Expire Popup/Redirection for WordPress <= 1.0 Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14153 affects the Page Expire Popup plugin (v1.0) with a CVSS score of 6.5. Authenticated attackers can exploit a SQL injection vulnerability. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-13746: ForumWP – Forum & Discussion Board <= 2.1.6 Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name PoC, Patch Analysis & Rule
CVE-2025-13746 affects the ForumWP plugin (up to v2.1.6) with a CVSS score of 6.4. It allows authenticated users to inject scripts via display names. Update to v2.1.7 to mitigate this stored XSS vulnerability.
March 18, 2026
CVE-2025-13409: Form Vibes – Database Manager for Forms <= 1.4.13 Authenticated (Admin+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-13409 affects the Form Vibes plugin for WordPress, allowing SQL injection in versions up to 1.4.13. Administrators should upgrade to version 1.5 to mitigate potential data exposure risks.
March 18, 2026
CVE-2025-68523: Spiffy Calendar <= 5.0.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68523 affects the Spiffy Calendar plugin (up to v5.0.7) with a medium severity score of 4.3. Authenticated attackers can exploit this to copy events without authorization. Upgrade to v5.0.8 to mitigate the risk.
March 18, 2026
CVE-2025-15364: Download Manager <= 3.3.40 Unauthenticated Limited Privilege Escalation via updatePassword PoC, Patch Analysis & Rule
The Download Manager plugin for WordPress (up to version 3.3.40) has a high severity vulnerability (CVE-2025-15364, CVSS 7.3) allowing unauthenticated attackers to change user passwords. Upgrade to version 3.3.41 to mitigate this risk.
March 18, 2026
CVE-2025-67926: Fluent Support <= 1.10.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67926 affects the Fluent Support plugin (up to version 1.10.4) with a CVSS score of 4.3. Ensure you update to version 1.10.5 to mitigate unauthorized access risks from authenticated users.
March 18, 2026
CVE-2026-24636: Sugar Calendar (Lite) <= 3.10.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24636 affects Sugar Calendar Lite plugin versions up to 3.10.1, with a CVSS score of 4.3. This medium-severity vulnerability allows authenticated attackers to perform unauthorized actions. Ensure you update to the patched version.
March 18, 2026
CVE-2025-67919: Woffice Core <= 5.4.30 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-67919 affects the Woffice Core plugin (up to version 5.4.30) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this IDOR vulnerability, so patching is essential for data integrity.
March 18, 2026
CVE-2025-68507: Icegram <= 3.1.35 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68507 affects the Icegram plugin (up to v3.1.35) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized actions. Update to v3.1.36 to mitigate risks from unauthenticated email submissions.
March 18, 2026
CVE-2026-24356: GetGenie <= 4.3.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24356 affects the Getgenie plugin (up to v4.3.0) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access for authenticated users. Upgrade to v4.3.1 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.