AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24555: ArtPlacer Widget <= 2.23.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24555 affects the Artplacer Widget plugin for WordPress (up to version 2.23.1) with a medium severity CVSS score of 6.4 due to stored cross-site scripting. Ensure to apply patches or implement WAF to mitigate risks.
March 18, 2026
CVE-2025-68072: Easy Property Listings <= 3.5.20 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68072 affects the Easy Property Listings plugin (up to v3.5.20) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive inspection calendar files. Update to v3.5.21 to mitigate this vulnerability.
March 18, 2026
CVE-2025-69185: Hotel Listing <= 1.4.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69185 affects the Hotel Listing plugin (up to v1.4.2) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-68059: Hotel Listing <= 1.4.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68059 affects the Hotel Listing plugin (v1.4.2) with a medium severity CVSS score of 4.3. Ensure you update to the patched version to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-69187: Final User <= 1.2.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69187 affects the Final User plugin (v1.2.5) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24563: LifePress <= 2.2.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24563 affects the LifePress plugin (up to v2.2.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v2.2.2 to mitigate this risk.
March 18, 2026
CVE-2025-69293: Final User <= 1.2.5 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-69293 reveals a high-severity privilege escalation vulnerability in the Final User WordPress plugin (up to v1.2.5). Authenticated users can gain admin access. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69186: Hospital Doctor Directory <= 1.3.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69186 affects the Hospital Doctor Directory plugin (up to 1.3.9) with a CVSS score of 5.3. It allows unauthorized access; users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69191: ListingHub <= 1.2.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69191 affects the ListingHub plugin for WordPress (up to v1.2.7) with a CVSS score of 5.3. This medium severity flaw allows unauthorized access, highlighting the need for immediate patching to secure your site.
March 18, 2026
CVE-2025-68057: Hospital Doctor Directory <= 1.3.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68057 affects the Hospital Doctor Directory plugin (up to version 1.3.9) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69183: Hospital Doctor Directory <= 1.3.9 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-69183 affects the Hospital Doctor Directory plugin (up to v1.3.9) with a CVSS score of 8.8. Authenticated users can escalate privileges to admin. Update to the patched version to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2025-13921: weDocs <= 2.1.16 Missing Authorization to Authenticated (Subscriber+) Documentation Post Update PoC, Patch Analysis & Rule
CVE-2025-13921 affects the weDocs plugin (up to v2.1.16) with a CVSS score of 4.3. It allows authenticated users to modify documentation. Update to v2.1.17 to mitigate this unauthorized access risk.
March 18, 2026
CVE-2025-69189: JobBank <= 1.2.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69189 affects the JobBank plugin (v1.2.3) with a medium severity score of 5.3. Unauthenticated attackers can exploit this flaw for unauthorized actions, highlighting the need for immediate patching.
March 18, 2026
CVE-2026-0914: WP DSGVO Tools (GDPR) <= 3.1.36 Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0914 affects the Shapepress Dsgvo plugin (up to 3.1.36) with a CVSS score of 6.4. This medium-severity stored XSS vulnerability allows authenticated users to inject scripts, impacting site security. Update to 3.1.37 to mitigate.
March 18, 2026
CVE-2025-68869: LazyTasks <= 1.2.37 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-68869 affects the Lazytasks Project Task Management plugin (up to 1.2.37) with a critical CVSS score of 9.8. Patch to version 1.3.01 to mitigate unauthenticated privilege escalation risks.
March 18, 2026
CVE-2025-68881: AppExperts <= 1.4.5 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-68881 reveals a medium severity SQL injection vulnerability in the AppExperts plugin for WordPress (up to version 1.4.5). Authenticated attackers can exploit this flaw to access sensitive database information. Update to the...
March 18, 2026
CVE-2025-68058: Institutions Directory <= 1.3..4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68058 affects the Institutions Directory plugin for WordPress (versions up to 1.3..4) with a medium severity (CVSS 4.3). Ensure to patch to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2025-69184: Institutions Directory <= 1.3.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69184 affects the Institutions Directory plugin for WordPress (up to version 1.3.4) with a CVSS score of 5.3. Ensure you patch to prevent unauthorized access by unauthenticated users.
March 18, 2026
CVE-2025-69181: Lawyer Directory <= 1.3.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69181 affects the Lawyer Directory plugin (v1.3.4 and earlier) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67967: Lawyer Directory <= 1.3.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67967 affects the Lawyer Directory plugin (up to v1.3.3) with a CVSS score of 4.3. It allows authenticated users to perform unauthorized actions. Ensure you update to the patched version to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.