AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69056: Hotel Listing <= 1.4.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
The Hotel Listing plugin for WordPress (up to version 1.4.0) has a medium severity XSS vulnerability (CVE-2025-69056) due to poor input sanitization. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-63021: Valenti Engine <= 1.0.3 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-63021 affects the Valenti Engine plugin for WordPress (up to version 1.0.3) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Users should update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2025-62140: Locatoraid Store Locator <= 3.9.65 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62140 affects the Locatoraid plugin (up to version 3.9.65) with a medium severity CVSS score of 4.4. Admin-level users can exploit stored XSS vulnerabilities, impacting multi-site setups. Patch to mitigate risks.
March 18, 2026
CVE-2025-62992: Everest Backup <= 2.3.9 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-62992 affects the Everest Backup plugin for WordPress (up to version 2.3.9) with a medium severity CVSS score of 4.3. Patch to version 2.3.11 to mitigate the risk of unauthorized actions via Cross-Site Request Forgery.
March 18, 2026
CVE-2025-69054: Super Logos Showcase <= 2.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69054 affects the Super Logos Showcase plugin for WordPress (up to version 2.8) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected XSS risks.
March 18, 2026
CVE-2025-49338: Flowbox <= 1.1.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-49338 affects the Flowbox plugin for WordPress (up to version 1.1.5) with a medium severity score of 5.3. Unauthenticated attackers can exploit this vulnerability, so patching is essential to prevent unauthorized access.
March 18, 2026
CVE-2025-49346: Simple Archive Generator <= 5.2 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-49346 affects the Simple Archive Generator plugin for WordPress (up to v5.2) with a Medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to mitigate unauthorized actions.
March 18, 2026
CVE-2025-62142: Post Video Players <= 1.163 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62142 affects the Video Playlist And Gallery Plugin (up to 1.163) with a medium severity (CVSS 4.4) stored XSS vulnerability. Patching is essential to prevent authenticated attackers from injecting scripts.
March 18, 2026
CVE-2025-62087: Sticky Notes for WP Dashboard <= 1.2.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62087 affects the Wb Sticky Notes plugin (up to v1.2.4) with a medium severity CVSS score of 4.3. Authenticated users can exploit this to perform unauthorized actions. Update to v1.2.5 to mitigate risks.
March 18, 2026
CVE-2025-59137: Behance Portfolio Manager <= 1.7.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-59137 affects the Portfolio Manager Powered By Behance plugin (up to v1.7.5) with a medium severity CVSS score of 4.3. Ensure you update to v1.8.0 to mitigate the Cross-Site Request Forgery risk.
March 18, 2026
CVE-2025-62143: Post Video Players <= 1.163 Authenticated (Contributor+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-62143 affects the Video Playlist And Gallery Plugin for WordPress, versions up to 1.163. This medium-severity vulnerability allows authenticated users to access sensitive data. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-59135: Behance Portfolio Manager <= 1.7.5 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-59135 affects the Portfolio Manager Powered By Behance plugin (up to v1.7.5) with a medium severity score of 4.4. Patch to v1.8.0 to mitigate stored XSS risks that allow admin-level script injection.
March 18, 2026
CVE-2025-63000: Sermon Manager <= 2.30.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-63000 affects the Sermon Manager plugin for WordPress (up to 2.30.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Update to the patched version.
March 18, 2026
CVE-2025-62098: Portfolio Gallery <= 1.4.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62098 affects the Gallery Portfolio plugin for WordPress (versions up to 1.4.8) with a medium severity CVSS score of 4.3. Patching is crucial to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-62744: Page Title Splitter <= 2.5.9 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-62744 affects the Page Title Splitter plugin (up to version 2.5.9) with a medium severity CVSS of 6.4. Authenticated users can exploit this stored XSS vulnerability, making patching essential to prevent client-side attacks.
March 18, 2026
CVE-2025-14947: All-in-One Video Gallery <= 4.6.4 Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion PoC, Patch Analysis & Rule
CVE-2025-14947 affects the All In One Video Gallery plugin (up to v4.6.4) with a medium severity (CVSS 6.5) vulnerability allowing unauthenticated attackers to modify videos. Upgrade to v4.7.1 to mitigate this risk.
March 18, 2026
CVE-2025-14745: RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode PoC, Patch Analysis & Rule
CVE-2025-14745 affects the Wp Rss Aggregator plugin (up to version 5.0.10) with a medium severity CVSS score of 6.4. Ensure you update to 5.0.11 to mitigate the stored XSS risk from authenticated users.
March 18, 2026
CVE-2025-69193: Membership <= 1.6.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69193 affects the Wp Membership plugin (up to version 1.6.4) with a medium severity CVSS score of 5.3. This vulnerability allows unauthorized actions by unauthenticated users, highlighting the need for immediate patching.
March 18, 2026
CVE-2025-68047: Eventin <= 4.1.3 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-68047 affects the Wp Event Solution plugin (up to version 4.1.3) with a CVSS score of 7.5. Authenticated users can exploit a PHP object injection vulnerability, leading to potential remote code execution. Update to version 4.1.4.
March 18, 2026
CVE-2025-69292: Membership <= 1.6.4 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-69292 affects the WP Membership plugin (up to v1.6.4) with a high severity CVSS score of 8.8, allowing privilege escalation for authenticated users. Update to the patched version to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.