AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24566: iNET Webkit <= 1.2.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24566 affects the iNET Webkit plugin for WordPress (v1.2.4) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67961: WPO365 <= 40.0 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-67961 affects the WPO365 Login plugin (up to version 40.0) with a medium severity (CVSS 6.4) SSRF vulnerability. Users should update to version 40.1 to mitigate risks from authenticated attackers exploiting this flaw.
March 18, 2026
CVE-2025-67960: WorkScout-Core <= 1.7.06 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67960 affects the Workscout Core plugin (up to 1.7.06) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows unauthenticated attackers to inject scripts, impacting user security. Update to the patched...
March 18, 2026
CVE-2026-24568: Travel <= 11.1.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24568 affects the Wp Travel plugin (up to version 11.1.0) with a CVSS score of 5.3. This medium severity vulnerability allows unauthorized access. Update to version 11.1.1 to mitigate risks.
March 18, 2026
CVE-2025-68035: Tabby Checkout <= 5.8.4 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2025-68035 affects the Tabby Checkout plugin for WordPress (up to version 5.8.4) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data, making it crucial to update to version 5.9.1.
March 18, 2026
CVE-2026-24990: WP Docs <= 2.2.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24990 affects WP Docs plugin versions up to 2.2.8, allowing authenticated users to perform unauthorized actions. Upgrade to 2.2.9 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2026-24570: Edwiser Bridge <= 4.3.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24570 affects the Edwiser Bridge plugin (up to v4.3.2) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v4.3.3 to mitigate this risk.
March 18, 2026
CVE-2025-68039: BackItUp <= 2.1.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68039 affects the Wp Backitup plugin (up to v2.1.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24565: B Accordion <= 2.0.2 Authenticated (Contributor+) Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24565 affects the B Accordion plugin (up to version 2.0.2) with a CVSS score of 4.3. Authenticated users can access sensitive data. Update to version 2.0.3 to mitigate this risk.
March 18, 2026
CVE-2025-69318: JobWP <= 2.4.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69318 affects the JobWP plugin (up to v2.4.5) with a CVSS score of 7.2 due to stored XSS vulnerabilities. Update to v2.4.6 to mitigate risks from potential attacks.
March 18, 2026
CVE-2026-24564: Textmetrics <= 3.6.3 Authenticated (Subscriber+) Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2026-24564 affects the Webtexttool plugin (up to v3.6.3) with a medium severity (CVSS 5.4) remote code execution vulnerability. Users should upgrade to v3.6.4 to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2025-67966: Lawyer Directory <= 1.3.3 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-67966 affects the Lawyer Directory plugin for WordPress (up to v1.3.3) with a CVSS score of 8.8. Authenticated users can escalate privileges to admin. Update to the patched version to mitigate this high-severity vulnerability.
March 18, 2026
CVE-2025-67963: Movie Booking <= 1.1.5 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-67963 affects the Movie Booking plugin (up to v1.1.5) with a critical CVSS score of 9.1, allowing unauthenticated file deletion. Users should patch immediately to mitigate potential remote code execution risks.
March 18, 2026
CVE-2025-68857: Paid Downloads <= 3.15 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-68857 affects the Paid Downloads plugin for WordPress, with a high severity CVSS score of 7.5. Unauthenticated SQL injection vulnerabilities in version 3.15 can lead to sensitive data exposure. Users should update to the...
March 18, 2026
CVE-2025-69180: Ultra Portfolio <= 6.7 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69180 affects the Ultra Portfolio plugin for WordPress (up to version 6.7) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit this SQL injection vulnerability to access sensitive data. Patching is...
March 18, 2026
CVE-2026-24569: Media Library File Size <= 1.6.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24569 affects the Media Library File Size plugin for WordPress (up to v1.6.7) with a CVSS score of 4.3. Patch to v1.6.8 to mitigate unauthorized access by authenticated users.
March 18, 2026
CVE-2026-24567: Anything Order by Terms <= 1.4.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24567 affects the Anything Order By Terms plugin for WordPress, allowing authenticated users to perform unauthorized actions. Users should update from version 1.4.0 to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2025-67968: Real Homes CRM <= 1.0.0 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-67968 reveals a high severity file upload vulnerability in the RealHomes CRM plugin for WordPress, allowing authenticated users to upload arbitrary files. Update to the patched version to mitigate potential remote code...
March 18, 2026
CVE-2025-67958: TaxCloud for WooCommerce <= 8.3.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67958 affects the Simple Sales Tax plugin for WordPress (up to version 8.3.8) with a CVSS score of 5.3. Unauthenticated attackers can exploit this medium severity flaw, so update to version 8.4.0 to mitigate risks.
March 18, 2026
CVE-2025-68866: Dinatur <= 1.18 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68866 affects the Dinatur plugin for WordPress (up to version 1.18) with a high severity CVSS score of 7.2. Unauthenticated XSS allows attackers to inject scripts, impacting user security. Update to the patched version to...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.