AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-67957: Listivo Core <= 2.3.77 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-67957 affects the Listivo Core plugin (up to version 2.3.77) with a high severity CVSS score of 8.1. This authentication bypass vulnerability allows attackers to execute arbitrary files, risking sensitive data exposure...
March 18, 2026
CVE-2026-0554: NotificationX <= 3.1.11 Missing Authorization to Authenticated (Contributor+) Analytics Reset PoC, Patch Analysis & Rule
CVE-2026-0554 affects the NotificationX plugin (up to version 3.1.11) with a medium severity (CVSS 4.3) vulnerability. Ensure you update to version 3.2.1 to prevent unauthorized data resets by authenticated users.
March 18, 2026
CVE-2026-0690: FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta PoC, Patch Analysis & Rule
CVE-2026-0690 affects the FlatPM plugin for WordPress, with a medium severity CVSS score of 6.4. Users should upgrade to version 3.2.3 to mitigate the stored XSS vulnerability that allows script injection by authenticated attackers.
March 18, 2026
CVE-2026-0608: Head Meta Data <= 20251118 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta PoC, Patch Analysis & Rule
CVE-2026-0608 affects the Head Meta Data plugin for WordPress, allowing authenticated users to inject scripts due to insufficient input sanitization. Update to version 20260105 to mitigate this medium severity XSS vulnerability.
March 18, 2026
CVE-2025-15380: NotificationX <= 3.2.0 Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' PoC, Patch Analysis & Rule
CVE-2025-15380 affects NotificationX plugin versions up to 3.2.0, with a CVSS score of 7.2. This high-severity XSS vulnerability allows attackers to inject scripts. Update to version 3.2.1 to mitigate risks.
March 18, 2026
CVE-2026-24577: Pie Register <= 3.8.4.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24577 affects the Pie Register plugin for WordPress (up to version 3.8.4.7) with a CVSS score of 5.3. It allows unauthorized access due to a missing capability check. Update to version 3.8.4.8 to mitigate this risk.
March 18, 2026
CVE-2026-0726: Nexter Extension – Site Enhancements Toolkit <= 4.4.6 Unauthenticated PHP Object Injection via 'nxt_unserialize_replace' PoC, Patch Analysis & Rule
CVE-2026-0726 affects the Nexter Extension plugin for WordPress (up to 4.4.6) with a high severity CVSS score of 8.1. Patch to version 4.4.7 to mitigate the risk of PHP Object Injection from unauthenticated attackers.
March 18, 2026
CVE-2026-0548: Tutor LMS – eLearning and online course solution <= 3.9.4 Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion PoC, Patch Analysis & Rule
CVE-2026-0548 affects Tutor plugin versions up to 3.9.4, allowing authenticated users to delete attachments due to a missing capability check. Upgrade to 3.9.5 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-15347: Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update PoC, Patch Analysis & Rule
CVE-2025-15347 affects the Creator LMS plugin (up to v1.1.12) with a CVSS score of 8.8. This high-severity vulnerability allows authenticated users to modify data, risking privilege escalation. Update to v1.1.13 to mitigate.
March 18, 2026
CVE-2025-15043: The Events Calendar <= 6.15.13 Missing Authorization to Authenticated (Subscriber+) Data Migration Control PoC, Patch Analysis & Rule
CVE-2025-15043 affects The Events Calendar plugin (up to version 6.15.13) with a medium severity (CVSS 5.4) vulnerability. Patch to 6.15.13.1 to prevent unauthorized access to migration functions.
March 18, 2026
CVE-2026-24575: WishList Member X <= 3.29.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24575 affects the WishList Member X plugin (up to v3.29.0) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Users should patch to the latest version to mitigate risks.
March 18, 2026
CVE-2025-68020: WANotifier <= 2.7.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68020 affects the WANotifier plugin (up to v2.7.12) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v2.7.13 to mitigate risks from this missing capability check.
March 18, 2026
CVE-2025-68046: Contact Form & Lead Form Elementor Builder <= 2.0.1 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-68046 affects the Lead Form Builder plugin for WordPress, allowing authenticated users to access sensitive data. Update to version 2.0.3 to mitigate this medium-severity vulnerability with a CVSS score of 4.3.
March 18, 2026
CVE-2025-69315: Simply Schedule Appointments <= 1.6.9.15 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69315 affects the Simply Schedule Appointments plugin (up to v1.6.9.15) with a medium severity CVSS score of 5.3. Ensure you update to v1.6.9.17 to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-24579: Ai Image Alt Text Generator for WP <= 1.1.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24579 affects the Ai Image Alt Text Generator for WP plugin (up to version 1.1.9) with a medium severity CVSS score of 4.3. Authenticated users can exploit this flaw for unauthorized actions; patching is recommended.
March 18, 2026
CVE-2026-25451: Bold Page Builder <= 5.6.7 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25451 affects the Bold Page Builder plugin (up to version 5.6.7) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so update to version 5.6.8 to mitigate risks.
March 18, 2026
CVE-2025-69316: TableOn <= 1.0.4.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69316 affects the Posts Table Filterable plugin for WordPress (up to version 1.0.4.2) with a CVSS score of 6.1. Ensure to patch to mitigate the reflected XSS risk from unauthenticated attackers.
March 18, 2026
CVE-2025-68840: iRobots.txt SEO <= 1.1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68840 affects the iRobots.txt SEO plugin for WordPress (up to version 1.1.2) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should patch to mitigate the risk of script injection.
March 18, 2026
CVE-2026-24576: UX Flat <= 5.4.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24576 affects the Ux Flat plugin for WordPress (up to version 5.4.0) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS vulnerabilities; ensure you patch to mitigate risks.
March 18, 2026
CVE-2026-22336: Directorist Booking <= 2.4.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-22336 affects the Directorist Booking plugin (up to v2.4.1) with a CVSS score of 7.5. This high-severity SQL injection allows unauthenticated attackers to extract sensitive data. Patching is essential to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.