AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-63053: Master Addons for Elementor <= 2.0.9.9.4 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-63053 affects the Master Addons for Elementor plugin (up to version 2.0.9.9.4) with a medium severity (CVSS 5.3) IDOR vulnerability. Users should update to version 2.1.0 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-49349: Reuters Direct <= 3.0.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-49349 affects the Reuters Direct plugin for WordPress (up to v3.0.0) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this vulnerability for unauthorized actions. Update to the patched version to...
March 18, 2026
CVE-2025-63005: Tooltips <= 10.8.3 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-63005 affects the WordPress Tooltips plugin up to version 10.8.3, exposing users to stored cross-site scripting. Patch to mitigate risks from authenticated attacks with a CVSS score of 6.4.
March 18, 2026
CVE-2025-62108: Add Custom Codes <= 4.80 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62108 affects the Add Custom Codes plugin for WordPress (up to version 4.80) with a medium severity (CVSS 4.3). Patch to version 5.0 to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-62146: MX Time Zone Clocks <= 5.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62146 affects the MX Time Zone Clocks plugin (up to version 5.1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities, making timely patching essential.
March 18, 2026
CVE-2025-62129: RestroPress <= 3.2.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62129 affects the RestroPress plugin (up to version 3.2.7) with a medium severity CVSS score of 5.3. Patch to version 3.2.8 to prevent unauthorized access from unauthenticated attackers.
March 18, 2026
CVE-2025-62149: Add Custom Codes <= 4.80 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62149 affects the Add Custom Codes plugin for WordPress (up to version 4.80) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, making timely patching to version 5.0 essential.
March 18, 2026
CVE-2025-62742: Curator.io <= 1.9.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62742 affects the Curatorio plugin for WordPress (up to version 1.9.5) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so update to version 1.9.6 to mitigate risks.
March 18, 2026
CVE-2025-62095: Bootstrap Modals <= 1.3.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62095 affects the Bootstrap Modals plugin for WordPress (up to version 1.3.2) with a CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-62134: Contact Form Widget <= 1.5.1 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-62134 affects the New Contact Form Widget plugin for WordPress (up to v1.5.1) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized actions.
March 18, 2026
CVE-2025-62096: Maximum Products per User for WooCommerce <= 4.4.3 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62096 affects the Maximum Products Per User for WooCommerce plugin (up to v4.4.3) with a medium severity CVSS score of 6.4. Update to v4.4.4 to mitigate stored XSS risks from authenticated users.
March 18, 2026
CVE-2025-62150: History Timeline <= 1.0.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62150 affects the Timeline Awesome plugin for WordPress (up to version 1.0.6) with a medium severity CVSS score of 4.3. Ensure you patch to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-62758: Funnelforms Free <= 3.8 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62758 affects the Funnelforms Free plugin (up to version 3.8) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can exploit this flaw, so ensure timely patching to mitigate risks.
March 18, 2026
CVE-2025-62756: The Moneytizer <= 10.0.9 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62756 affects The Moneytizer plugin for WordPress (up to version 10.0.9) with a medium severity CVSS score of 6.4. Patch to version 10.0.10 to mitigate stored XSS risks from authenticated users.
March 18, 2026
CVE-2025-66158: Gmaper for Elementor <= 1.0.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66158 affects the Gmaper Elementor plugin (up to v1.0.9) with a CVSS score of 4.3. This medium severity vulnerability allows authenticated users to perform unauthorized actions. Ensure you update to the patched version.
March 18, 2026
CVE-2025-62757: WebMan Amplifier <= 1.5.12 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62757 affects the Webman Amplifier plugin for WordPress (up to version 1.5.12) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to version 1.6.0 to mitigate risks.
March 18, 2026
CVE-2025-49355: Accessibility Press <= 1.0.2 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-49355 affects the Ilogic Accessibility plugin for WordPress (up to version 1.0.2) with a medium severity score of 4.4. Admin-level attackers can exploit this stored XSS vulnerability, so patching is essential.
March 18, 2026
CVE-2025-63038: Custom Admin Interface <= 7.40 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-63038 affects the Wp Custom Admin Interface plugin (up to version 7.40) with a medium severity CVSS score of 4.3. Update to version 7.41 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-62133: FormFacade <= 1.4.1 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-62133 affects the FormFacade plugin for WordPress (up to v1.4.1) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to mitigate unauthorized actions from unauthenticated attackers.
March 18, 2026
CVE-2025-14428: My Sticky Elements <= 2.3.3 Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion PoC, Patch Analysis & Rule
CVE-2025-14428 affects the My Sticky Elements plugin (up to v2.3.3) with a CVSS score of 4.3. Authenticated users can delete all stored contact form leads. Upgrade to v2.3.4 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.