AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24986: Simple Membership WP user Import <= 1.9.1 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24986 affects the Simple Membership WP User Import plugin (up to v1.9.1) with a medium severity score of 4.3 due to CSRF vulnerabilities. Patching is essential to prevent unauthorized actions by unauthenticated attackers.
March 18, 2026
CVE-2026-24578: Admin login URL Change <= 1.1.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24578 affects the Admin Login Url Change plugin (up to v1.1.5) with a medium severity CVSS score of 4.3. Authenticated users can exploit this flaw for unauthorized actions; patching is recommended.
March 18, 2026
CVE-2025-68030: Frontis Blocks <= 1.1.5 Unauthenticated Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-68030 affects the Frontis Blocks plugin (up to v1.1.5) with a medium severity CVSS score of 6.5. Patch to v1.1.6 to mitigate the Server-Side Request Forgery vulnerability that could expose internal services.
March 18, 2026
CVE-2025-68839: Easy Theme Options <= 1.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68839 reveals a medium severity XSS vulnerability in the Easy Theme Options plugin for WordPress, allowing unauthenticated attackers to inject scripts. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67944: Nelio AB Testing <= 8.1.8 Authenticated (Editor+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2025-67944 affects the Nelio A/B Testing plugin (up to 8.1.8) with a CVSS score of 7.2. Authenticated users can exploit this high-severity remote code execution vulnerability. Upgrade to version 8.2.0 to mitigate risks.
March 18, 2026
CVE-2025-12573: Bookingor <= 1.0.12 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-12573 affects the Bookingor plugin for WordPress (up to version 1.0.12) with a medium severity CVSS score of 4.3. Update to version 1.0.13 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-67945: MailerLite – WooCommerce integration <= 3.1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-67945 affects the Woo Mailerlite plugin (up to v3.1.2) with a CVSS score of 7.5 due to SQL injection vulnerabilities. Upgrade to v3.1.3 to mitigate the risk of data extraction by attackers.
March 18, 2026
CVE-2025-67947: AdForest Elementor <= 3.0.11 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67947 affects the Adforest Elementor plugin (up to v3.0.11) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows unauthenticated attackers to inject scripts. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67953: Booking Activities <= 1.16.44 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2025-67953 affects the Booking Activities plugin for WordPress (up to version 1.16.44) with a critical CVSS score of 9.8. Update to version 1.16.45 to mitigate the risk of unauthenticated privilege escalation.
March 18, 2026
CVE-2025-68838: MemberPress Discord Addon <= 1.1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68838 affects the MemberPress Discord Addon plugin for WordPress (up to version 1.1.4) with a CVSS score of 6.1. Ensure you patch to mitigate the reflected XSS risk that could allow script injection.
March 18, 2026
CVE-2026-22850: Koko Analytics <= 2.1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-22850 affects Koko Analytics plugin versions up to 2.1.2 with a high severity score of 7.5. Unauthenticated SQL injection can expose sensitive data; update to version 2.1.3 to mitigate risks.
March 18, 2026
CVE-2025-68882: Scalenut <= 1.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68882 affects the Scalenut WordPress plugin (up to version 1.1.3) with a medium severity CVSS score of 5.3. Ensure you update to version 1.1.4 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68835: Ravpage <= 2.33 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68835 affects the Ravpage plugin for WordPress (up to version 2.33) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected cross-site scripting risks.
March 18, 2026
CVE-2026-22337: Directorist Social Login <= 2.1.1 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-22337 is a critical privilege escalation vulnerability in the Directorist Social Login plugin for WordPress, affecting version 2.1.1. Unauthenticated attackers can gain admin access, so patch immediately.
March 18, 2026
CVE-2025-68858: wpCAS <= 1.07 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68858 affects the wpCAS plugin (v1.07) with a medium severity score of 6.1 due to reflected cross-site scripting. Users should update to the patched version to mitigate the risk of arbitrary script injection.
March 18, 2026
CVE-2026-1042: WP Hello Bar <= 1.02 Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters PoC, Patch Analysis & Rule
CVE-2026-1042 affects the WP Hello Bar plugin (up to v1.02) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit stored XSS vulnerabilities, making it crucial to update to the patched version.
March 18, 2026
CVE-2025-14351: Custom Fonts – Host Your Fonts Locally <= 2.1.16 Missing Authorization to Unauthenticated Font Deletion PoC, Patch Analysis & Rule
CVE-2025-14351 affects the Custom Fonts plugin (up to v2.1.16) with a CVSS score of 5.3. This medium-severity flaw allows unauthenticated users to delete font directories. Update to v2.1.17 to mitigate risks.
March 18, 2026
CVE-2025-14348: weMail <= 2.0.7 Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure PoC, Patch Analysis & Rule
CVE-2025-14348 affects the weMail plugin (up to v2.0.7) with a CVSS score of 5.3. Unauthenticated attackers can bypass authentication to access subscriber data. Upgrade to v2.0.8 to mitigate this risk.
March 18, 2026
CVE-2025-14533: Advanced Custom Fields: Extended <= 0.9.2.1 Unauthenticated Privilege Escalation via Insert User Form Action PoC, Patch Analysis & Rule
CVE-2025-14533 affects the Acf Extended plugin for WordPress (up to version 0.9.2.1) with a critical CVSS score of 9.8. Patch to version 0.9.2.2 to mitigate unauthorized privilege escalation risks.
March 18, 2026
CVE-2026-1045: Viet contact <= 1.3.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters PoC, Patch Analysis & Rule
CVE-2026-1045 affects the Viet Contact plugin for WordPress (up to 1.3.2) with a CVSS score of 4.4. This medium severity XSS vulnerability can be exploited by authenticated admins, impacting multisite installations. Patching is advised.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.