AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-67923: JetEngine <= 3.7.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67923 affects the Jet Engine plugin (up to version 3.7.7) with a CVSS score of 7.2. This high-severity XSS vulnerability allows unauthenticated attackers to inject scripts. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69345: Post and Page Builder by BoldGrid <= 1.27.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69345 affects the Post and Page Builder plugin (up to v1.27.9), allowing unauthorized actions by authenticated users. Upgrade to v1.27.10 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-67927: Link Whisper Free <= 0.8.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67927 affects the Link Whisper plugin (up to version 0.8.8) with a medium severity CVSS score of 6.1 due to a reflected XSS vulnerability. Users should update to version 0.8.9 to mitigate potential attacks.
March 18, 2026
CVE-2025-68558: Depicter Slider <= 4.0.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68558 affects the Depicter plugin for WordPress (up to 4.0.4) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized file uploads. Users should update to version 4.0.5 to mitigate this risk.
March 18, 2026
CVE-2025-67915: Timetics <= 1.0.46 Incorrect Authorization to Authenticated (Timetics Customer+) User Creation PoC, Patch Analysis & Rule
CVE-2025-67915 affects the Timetics plugin (up to v1.0.46) with a medium severity (CVSS 5.3) flaw allowing unauthorized user account creation. Users should update to v1.0.48 to mitigate this risk.
March 18, 2026
CVE-2025-69091: Demo Importer Plus <= 2.0.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69091 affects the Demo Importer Plus plugin (up to v2.0.8) with a medium severity score of 4.3. Ensure you update to v2.0.9 to mitigate unauthorized access risks from authenticated users.
March 18, 2026
CVE-2026-22466: MapIt <= 3.0.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22466 affects the Wp Mapit plugin (up to version 3.0.3) with a medium severity CVSS score of 4.3. Authenticated users can exploit a missing capability check, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-22468: Absolute Addons For Elementor <= 1.0.14 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22468 affects the Absolute Addons plugin for WordPress (up to version 1.0.14) with a medium severity CVSS score of 4.3. Ensure to patch to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2026-22462: Add Polylang support for Customizer <= 1.4.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-22462 affects the Add Polylang Support For Customizer plugin (up to version 1.4.5) with a medium severity CVSS score of 4.3. Ensure to patch to mitigate unauthorized actions via CSRF attacks.
March 18, 2026
CVE-2025-67928: Automotive Listings <= 18.6 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-67928 affects the Automotive Listings plugin for WordPress (up to version 18.6) with a CVSS score of 7.5. Unauthenticated SQL injection can lead to unauthorized data extraction; patching is essential.
March 18, 2026
CVE-2026-22464: My auctions allegro <= 3.6.33 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-22464 affects the My Auctions Allegro Free Edition plugin (up to 3.6.33) with a CVSS score of 7.5. Authenticated attackers can exploit this authentication bypass to execute arbitrary PHP code. Update to 3.6.34 to mitigate risks.
March 18, 2026
CVE-2026-22463: Form to Chat App <= 1.2.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-22463 affects the Form To Chat plugin (up to version 1.2.5) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, so ensure timely patching to protect your site.
March 18, 2026
CVE-2026-22445: Apimo Connector <= 2.6.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22445 affects the Apimo Connector plugin for WordPress (up to 2.6.4) with a medium severity (CVSS 5.3) due to missing authorization checks, allowing unauthorized actions. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-63019: Cookies and Content Security Policy <= 2.34 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2025-63019 affects the Cookies And Content Security Policy plugin (up to v2.34) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data. Upgrade to v2.35 to mitigate this risk.
March 18, 2026
CVE-2025-47555: Tutor LMS <= 3.9.4 Authenticated (Instructor+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-47555 affects Tutor LMS plugin versions up to 3.9.4, allowing authenticated users to exploit insecure object references. Update to version 3.9.5 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-68044: Five Star Restaurant Reservations <= 2.7.4 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-68044 affects the Restaurant Reservations plugin (up to v2.7.4) with a medium severity CVSS score of 5.3. Unauthenticated users can exploit this IDOR vulnerability, so update to v2.7.5 to mitigate risks.
March 18, 2026
CVE-2026-22461: CTX Feed <= 6.6.18 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-22461 affects the Webappick Product Feed For Woocommerce plugin (up to version 6.6.18) with a CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability, so update to version 6.6.19 to mitigate risks.
March 18, 2026
CVE-2025-68509: User Submitted Posts <= 20251121 Unauthenticated Open Redirect PoC, Patch Analysis & Rule
CVE-2025-68509 affects the User Submitted Posts plugin for WordPress, with a medium severity CVSS of 5.3. Users should update to version 20251210 to mitigate the open redirect vulnerability that could lead to phishing attacks.
March 18, 2026
CVE-2025-14627: WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass PoC, Patch Analysis & Rule
CVE-2025-14627 affects WP Ultimate CSV Importer versions up to 7.35, allowing authenticated users to exploit SSRF vulnerabilities. Upgrade to version 7.36 to mitigate risks of internal data exposure.
March 18, 2026
CVE-2025-14998: Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
CVE-2025-14998 affects the Branda White Labeling plugin (versions
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.