AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14978: PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
CVE-2025-14978 affects the Peachpay for WooCommerce plugin (up to version 1.119.8) with a medium severity CVSS score of 5.3. Unauthenticated attackers can modify WooCommerce order statuses; update to version 1.119.9 to mitigate.
March 18, 2026
CVE-2025-14977: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure PoC, Patch Analysis & Rule
CVE-2025-14977 affects Dokan Lite plugin versions up to 4.2.4, allowing authenticated attackers to exploit a high-severity remote code execution flaw. Upgrade to 4.2.5 to mitigate risks associated with unauthorized access to sensitive...
March 18, 2026
CVE-2026-1051: Newsletter – Send awesome emails from WordPress <= 9.1.0 Cross-Site Request Forgery to Newsletter Unsubscription PoC, Patch Analysis & Rule
CVE-2026-1051 affects the Newsletter plugin for WordPress versions up to 9.1.0, exposing users to Cross-Site Request Forgery. Upgrade to 9.1.1 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-69313: PostX <= 5.0.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69313 affects the Ultimate Post plugin (versions
March 18, 2026
CVE-2025-14798: LearnPress – WordPress LMS Plugin <= 4.3.2.4 Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API PoC, Patch Analysis & Rule
CVE-2025-14798 affects LearnPress plugin versions up to 4.3.2.4, allowing unauthenticated attackers to access sensitive user data. Upgrade to version 4.3.2.5 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-69312: Xpro Elementor Addons <= 1.4.19.1 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
CVE-2025-69312 affects the Xpro Elementor Addons plugin (up to version 1.4.19.1) with a CVSS score of 8.8. Authenticated attackers can exploit a file upload vulnerability, making timely patching essential.
March 18, 2026
CVE-2025-69311: Broadstreet Ads <= 1.52.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69311 affects the Broadstreet WordPress plugin (up to version 1.52.1) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Update to version 1.52.2 to mitigate this risk.
March 18, 2026
CVE-2025-67943: My auctions allegro <= 3.6.32 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67943 reveals a high-severity XSS vulnerability in the My Auctions Allegro Free Edition plugin (up to 3.6.32). Update to version 3.6.33 to mitigate risks of script injection attacks.
March 18, 2026
CVE-2026-24580: Ecwid Shopping Cart <= 7.0.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24580 affects the Ecwid Shopping Cart plugin (up to v7.0.5) with a medium severity (CVSS 4.3) vulnerability. Update to v7.0.6 to prevent unauthorized actions by authenticated users.
March 18, 2026
CVE-2026-24581: Points and Rewards for WooCommerce <= 2.9.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24581 affects the Points And Rewards For WooCommerce plugin (up to v2.9.5) with a CVSS score of 4.3. Authenticated users can exploit this remote code execution flaw, so update to v2.9.6 to mitigate risks.
March 18, 2026
CVE-2025-15466: Image Photo Gallery Final Tiles Grid <= 3.6.9 Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management PoC, Patch Analysis & Rule
CVE-2025-15466 affects the Final Tiles Grid Gallery Lite plugin (up to version 3.6.9) with a medium severity (CVSS 5.4) vulnerability allowing unauthorized data access. Update to version 3.6.10 to mitigate risks.
March 18, 2026
CVE-2025-68019: SEO Booster <= 6.1.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68019 affects the SEO Booster plugin (versions up to 6.1.8) with a medium severity (CVSS 5.3) due to missing capability checks, allowing unauthorized actions. Users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-25453: Advanced iFrame <= 2025.10 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25453 affects the Advanced Iframe plugin for WordPress versions up to 2025.10, exposing users to stored XSS attacks. Upgrade to version 2026.0 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-68004: My Post Order <= 1.2.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68004 affects the My Posts Order plugin for WordPress (up to v1.2.1.1) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected XSS risks.
March 18, 2026
CVE-2025-68894: ShoutOut <= 4.0.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68894 affects the Shoutout plugin (up to version 4.0.2) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2026-24583: SumUp Payment Gateway For WooCommerce <= 2.7.9 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24583 affects the SumUp Payment Gateway for WooCommerce plugin (up to 2.7.9) with a medium severity CVSS score of 5.3. Patch to version 2.7.10 to prevent unauthorized access to REST API endpoints.
March 18, 2026
CVE-2025-68836: Table of Contents Creator <= 1.6.4.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68836 affects the Table Of Contents Creator plugin for WordPress (up to 1.6.4.1) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate reflected XSS risks.
March 18, 2026
CVE-2025-68018: Order Listener for WooCommerce <= 3.6.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68018 affects the Woc Order Alert plugin for WordPress (up to version 3.6.1) with a CVSS score of 5.3. Users should upgrade to version 3.6.2 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68073: GDPR CCPA Compliance Support <= 2.7.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68073 affects the Ninja GDPR Compliance plugin (up to 2.7.4) with a medium severity score of 4.3. Authenticated attackers can exploit a missing capability check. Upgrade to version 2.7.5 to mitigate this risk.
March 18, 2026
CVE-2026-24584: Tutor LMS BunnyNet Integration <= 1.0.0 Authenticated (Tutor instructor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24584 affects the Tutor LMS BunnyNet Integration plugin (up to v1.0.0) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS; update to v1.0.1 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.