AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69182: Institutions Directory <= 1.3.4 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-69182 affects the Institutions Directory plugin (v1.3.4 and earlier) with a high severity CVSS score of 8.8, allowing privilege escalation for authenticated users. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-69192: Real Estate Pro <= 2.1.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69192 affects the Real Estate Pro plugin (v2.1.5) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24558: ABG Rich Pins <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24558 affects the ABG Rich Pins plugin for WordPress (up to v1.1) with a medium severity (CVSS 6.4) XSS vulnerability. Ensure you patch to the latest version to mitigate potential script injection risks.
March 18, 2026
CVE-2025-69188: Fitness Trainer <= 1.7.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69188 affects the Fitness Trainer plugin for WordPress (up to version 1.7.1) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2025-67964: Homey Core <= 2.4.3 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67964 affects the Homey Core plugin for WordPress (up to version 2.4.3) with a high severity CVSS score of 7.2 due to stored XSS vulnerabilities. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24561: FluentBoards <= 1.91.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24561 affects the Fluent Boards plugin (up to version 1.91.1) with a medium severity CVSS score of 4.3. Patch to version 1.91.2 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-14892: Prime Listing Manager <= 1.1 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
CVE-2025-14892 affects the Prime Listing Manager plugin (v1.1) with a critical CVSS score of 9.8. Unauthenticated attackers can escalate privileges via account takeover. Ensure you update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-24556: ElementCamp <= 2.3.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24556 affects the Element Camp plugin (up to v2.3.2) with a CVSS score of 5.3, allowing unauthorized access. Update to the patched version to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2026-0920: LA-Studio Element Kit for Elementor <= 1.5.6.3 Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter PoC, Patch Analysis & Rule
CVE-2026-0920 affects the Lastudio Element Kit plugin (up to version 1.5.6.3) with a critical CVSS score of 9.8. Unauthenticated attackers can gain admin access; patch immediately to secure your site.
March 18, 2026
CVE-2026-1036: Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 Missing Authorization to Unauthenticated Arbitrary Comment Deletion PoC, Patch Analysis & Rule
CVE-2026-1036 affects the Photo Gallery plugin (up to v1.8.36) with a CVSS score of 5.3. Unauthenticated attackers can delete image comments. Ensure you update to the patched version to mitigate this vulnerability.
March 18, 2026
CVE-2026-24562: Ryviu – Product Reviews for WooCommerce <= 3.1.26 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24562 affects the Ryviu plugin (up to version 3.1.26) with a medium severity CVSS score of 5.3. It allows unauthorized actions by unauthenticated attackers; ensure you patch to mitigate this risk.
March 18, 2026
CVE-2025-69319: Beaver Builder <= 2.9.4.1 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2025-69319 affects Beaver Builder Lite up to version 2.9.4.1, allowing remote code execution for authenticated users. Upgrade to 2.9.4.2 to mitigate this high-severity vulnerability with a CVSS score of 8.8.
March 18, 2026
CVE-2026-1235: eCommerce <= 3.15.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2026-1235 affects the Wp E Commerce plugin (up to 3.15.1) with a high severity CVSS score of 8.1. This file upload vulnerability allows unauthenticated attackers to inject PHP objects, risking data exposure and code execution.
March 18, 2026
CVE-2026-24557: Contact Form 7 GetResponse Extension <= 1.0.8 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24557 affects the Contact Form 7 GetResponse Extension plugin (up to v1.0.8) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data; patching is essential to mitigate this risk.
March 18, 2026
CVE-2025-68027: Hydra Booking <= 1.1.32 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-68027 affects the Hydra Booking plugin (versions up to 1.1.32) with a critical CVSS score of 9.8, allowing unauthenticated attackers to gain admin privileges. Upgrade to version 1.1.33 to mitigate this vulnerability.
March 18, 2026
CVE-2026-24571: BOX NOW Delivery <= 3.0.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24571 affects the Box Now Delivery plugin (versions ≤3.0.2) with a medium severity (CVSS 4.3). It allows authenticated attackers to perform unauthorized actions. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67954: Salon booking system <= 10.30.3 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-67954 affects the Salon Booking System plugin for WordPress, allowing authenticated users to access sensitive data. Update to version 10.30.4 to mitigate this low-severity vulnerability.
March 18, 2026
CVE-2025-67955: MyHome Core <= 4.1.0 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-67955 affects the Myhome Core plugin for WordPress (up to v4.1.0) with a high severity CVSS score of 8.1. This authentication bypass vulnerability allows unauthenticated file inclusion, risking sensitive data exposure. Patching...
March 18, 2026
CVE-2026-24572: Nelio Content <= 4.2.0 Authenticated (Contributor+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-24572 affects the Nelio Content plugin for WordPress (up to version 4.2.0) with a medium severity score of 6.5. Authenticated attackers can exploit this SQL injection vulnerability to extract sensitive data. Update to 4.2.1.
March 18, 2026
CVE-2025-67956: User Registration <= 4.4.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67956 affects the User Registration plugin for WordPress (up to 4.4.6) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to version 4.4.7 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.