AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14047: WP User Frontend <= 4.2.4 Missing Authorization to Unauthenticated Arbitrary Attachment Deletion PoC, Patch Analysis & Rule
CVE-2025-14047 affects the WP User Frontend plugin (up to version 4.2.4) with a CVSS score of 5.3. It allows unauthenticated users to delete attachments. Update to version 4.2.5 to mitigate this vulnerability.
March 18, 2026
CVE-2025-69055: BM Content Builder < 3.16.3.3 Authenticated (Contributor+) Arbitrary File Download PoC, Patch Analysis & Rule
CVE-2025-69055 affects the BM Builder plugin for WordPress, allowing authenticated users to read arbitrary files due to a path traversal vulnerability. Update to version 3.16.3.3 to mitigate this medium severity issue.
March 18, 2026
CVE-2026-22388: Owl Carousel WP <= 2.2.2 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-22388 affects the Owl Carousel WP plugin (up to 2.2.2) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit this XSS vulnerability. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-62743: MyBookTable Bookstore <= 3.5.6 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62743 affects the MyBookTable plugin for WordPress (up to 3.5.6) with a medium severity (CVSS 6.4) due to stored XSS. Ensure you update to the patched version to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2025-62113: Co-marquage service-public.fr <= 0.5.77 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-62113 affects the Co Marquage Service Public plugin for WordPress (up to 0.5.77) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized actions.
March 18, 2026
CVE-2025-68867: Effect Maker <= 1.2.1 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68867 affects the Effect Maker plugin for WordPress (up to version 1.2.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability, necessitating immediate patching.
March 18, 2026
CVE-2025-69341: WeDesignTech Ultimate Booking Addon <= 1.0.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69341 affects the WeDesignTech Ultimate Booking Addon plugin for WordPress (up to v1.0.3) with a medium severity (CVSS 4.3). Patch immediately to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-68529: Email Capture <= 3.12.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-68529 affects WP Email Capture plugin versions up to 3.12.5, exposing a medium severity CSRF vulnerability (CVSS 4.3). Upgrade to 3.12.6 to mitigate unauthorized actions by attackers.
March 18, 2026
CVE-2025-67911: Newsletters <= 4.11 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-67911 affects the Newsletters Lite plugin for WordPress (up to v4.11) with a CVSS score of 8.1. This high-severity file upload vulnerability allows unauthenticated attackers to inject PHP objects, risking data integrity...
March 18, 2026
CVE-2025-66153: Headinger for Elementor <= 1.1.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66153 affects the Headinger Elementor plugin (v1.1.4) with a CVSS score of 4.3. Authenticated users can exploit a missing capability check to perform unauthorized actions. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-62989: Cooked <= 1.11.3 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62989 affects the Cooked plugin for WordPress (up to 1.11.3) with a medium severity (CVSS 4.4) stored XSS vulnerability. Patch to version 1.11.4 to mitigate risks associated with authenticated attacks in multi-site setups.
March 18, 2026
CVE-2025-69084: Photo Gallery <= 2.7.7.26 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69084 affects the Gt3 Photo Video Gallery plugin (versions up to 2.7.7.26) with a medium severity CVSS score of 6.1. Users should update to version 2.7.7.27 to mitigate reflected cross-site scripting risks.
March 18, 2026
CVE-2025-66150: Appender <= 1.1.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66150 affects the Appender plugin for WordPress (up to v1.1.1) with a medium severity CVSS score of 4.3. Ensure you patch to prevent unauthorized actions by low-privilege authenticated users.
March 18, 2026
CVE-2025-62121: Logo Slider , Logo Carousel , Logo showcase , Client Logo <= 1.8.1 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62121 affects the Tc Logo Slider plugin for WordPress (up to v1.8.1) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit stored XSS, so ensure proper patching and input sanitization.
March 18, 2026
CVE-2025-62125: Custom Background Changer <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62125 affects the Custom Background Changer plugin for WordPress (up to version 3.0) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2025-49345: WP-EasyArchives <= 3.1.2 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-49345 affects the WP Easyarchives plugin (up to v3.1.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2025-62138: Advanced PDF <= 1.1.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62138 affects the WP Advanced PDF plugin (up to version 1.1.7) with a CVSS score of 5.3. It allows unauthorized access, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-63014: Gmedia Photo Gallery <= 1.24.1 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-63014 affects the Grand Media plugin for WordPress, with a medium severity CVSS score of 4.3. Update to version 1.25.0 to mitigate Cross-Site Request Forgery risks from unauthenticated attackers.
March 18, 2026
CVE-2025-63022: Simple Like Page <= 1.5.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-63022 affects the Simple Facebook Plugin (up to version 1.5.3) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this vulnerability; ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-63040: Post Snippets <= 4.0.11 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-63040 affects the Post Snippets plugin for WordPress (up to version 4.0.11) with a medium severity CVSS score of 4.3. Patch to version 4.0.12 to mitigate unauthorized actions via cross-site request forgery.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.