AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-13
CVE-2025-69097: WPLMS <= 1.9.9.5.4 – Unauthenticated Arbitrary File Deletion (wplms_plugin)
The WPLMS Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.9.9.5.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such…
2026-01-13
CVE-2025-15486: Kunze Law <= 2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting (kunze-law)
The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and…
2026-01-13
CVE-2025-69001: FluentForm <= 6.1.11 – Unauthenticated Arbitrary Shortcode Execution (fluentform)
The The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.1.11. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes…
2026-01-13
CVE-2025-14379: Testimonials Creator 1.6 – Authenticated (Admin+) Stored Cross-Site Scripting (testimonials-creator)
The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.…
2026-01-13
CVE-2025-69098: Hide My WP <= 6.2.12 – Reflected Cross-Site Scripting (hide_my_wp)
The Hide My WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 6.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
2026-01-13
CVE-2026-0694: SearchWiz <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (searchwiz)
The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using `esc_attr()` instead of `esc_html()` when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above,…
2026-01-13
CVE-2026-0635: Responsive Accordion Slider <= 1.2.2 – Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images' (responsive-accordion-slider)
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify any slider's image metadata including titles, descriptions, alt text,…
2026-01-13
CVE-2025-14725: Internal Link Builder <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings (internal-link-builder)
The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever…
2026-01-13
CVE-2026-0717: LottieFiles – Lottie block for Gutenberg <= 3.0.0 – Unauthenticated Sensitive Information Exposure (lottiefiles)
The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the…
2026-01-13
CVE-2025-14464: PDF Resume Parser <= 1.0 – Unauthenticated Sensitive Information Disclosure in SMTP Credentials (pdf-resume-parser)
The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin registering an AJAX action handler that is accessible to unauthenticated users and exposes SMTP configuration data including credentials. This makes it possible for unauthenticated attackers to extract sensitive…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.