AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14866: Melapress Role Editor <= 1.1.1 Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment PoC, Patch Analysis & Rule
CVE-2025-14866 affects the Melapress Role Editor plugin (up to 1.1.1) with a CVSS score of 8.8. Authenticated users can escalate privileges. Update to the patched version to mitigate this vulnerability.
March 18, 2026
CVE-2025-69386: RVCFDI para Woocommerce <= 8.1.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69386 affects the Rvcfdi Para Woocommerce plugin (up to v8.1.8) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to the patched version to mitigate potential attacks.
March 18, 2026
CVE-2026-24962: Sigmize <= 0.0.9 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24962 affects the Sigmize plugin (up to v0.0.9) with a medium severity CVSS score of 4.3 due to a Cross-Site Request Forgery vulnerability. Update to v0.0.10 to mitigate unauthorized actions by attackers.
March 18, 2026
CVE-2025-15027: JAY Login & Register <= 2.6.03 Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user PoC, Patch Analysis & Rule
CVE-2025-15027 affects the JAY Login Register plugin for WordPress (up to 2.6.03) with a critical CVSS score of 9.8. Update to version 2.6.04 to mitigate the privilege escalation risk.
March 18, 2026
CVE-2025-15100: JAY Login & Register <= 2.6.03 Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile PoC, Patch Analysis & Rule
CVE-2025-15100 affects the Jay Login Register plugin for WordPress, versions 2.6.03 and earlier, with a CVSS score of 8.8. Users should upgrade to version 2.6.04 to mitigate the high-risk privilege escalation vulnerability.
March 18, 2026
CVE-2026-0632: Fluent Forms Pro Add On Pack <= 6.1.12 Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' PoC, Patch Analysis & Rule
CVE-2026-0632 affects the Fluent Forms Pro Add On Pack plugin (up to version 6.1.12) with a medium severity CVSS score of 5.4. Authenticated users can exploit this Server-Side Request Forgery vulnerability, making patching essential.
March 18, 2026
CVE-2025-15476: The Bucketlister <= 0.1.5 Missing Authorization to Authenticated (Subscriber+) Bucket List Modification PoC, Patch Analysis & Rule
CVE-2025-15476 affects The Bucketlister plugin (v0.1.5) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can modify bucket list items due to a missing capability check. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-1608: Video Onclick <= 0.4.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1608 affects the Video Onclick plugin (up to v0.4.7) with a medium severity CVSS score of 6.4 due to stored XSS. Authenticated attackers can inject scripts, impacting user security. Ensure you update to the patched version.
March 18, 2026
CVE-2026-0555: Premmerce <= 1.3.20 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint PoC, Patch Analysis & Rule
CVE-2026-0555 affects the Premmerce WordPress plugin (up to version 1.3.20) with a medium severity CVSS score of 6.4. Patch to version 1.3.21 to mitigate the stored XSS risk from authenticated attackers.
March 18, 2026
CVE-2025-15477: The Bucketlister <= 0.1.5 Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2025-15477 affects The Bucketlister plugin for WordPress (up to version 0.1.5) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated attackers can exploit this to access sensitive database information.
March 18, 2026
CVE-2026-1570: Simple Bible Verse via Shortcode <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1570 affects the Simple Bible Verse Via Shortcode plugin (up to v1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so patching is essential.
March 18, 2026
CVE-2026-1611: Wikiloops Track Player <= 1.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1611 affects the Wikiloops Track Player plugin (up to v1.0.1) with a CVSS score of 6.4. This medium severity XSS vulnerability allows authenticated users to inject scripts. Ensure you update to the patched version to mitigate...
March 18, 2026
CVE-2026-1634: Subitem AL Slider <= 1.0.0 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2026-1634 affects the Subitem Al Slider plugin for WordPress (v1.0.0 and below) with a medium severity rating (CVSS 6.1). Users should patch to mitigate reflected XSS risks from inadequate input sanitization.
March 18, 2026
CVE-2026-1573: OMIGO <= 3.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1573 affects the Omigo plugin for WordPress (up to version 3.3) with a medium severity (CVSS 6.4) due to stored XSS. Ensure you update to the patched version to mitigate potential script injection risks.
March 18, 2026
CVE-2026-1643: MP-Ukagaka <= 1.5.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1643 affects the Mp Ukagaka plugin for WordPress (up to version 1.5.2) with a medium severity CVSS score of 6.1. Ensure to patch to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2026-1082: TITLE ANIMATOR <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1082 affects the Title Animator plugin for WordPress (v1.0) with a medium severity CVSS score of 4.3. Ensure you patch for Cross-Site Request Forgery risks that allow unauthorized settings changes.
March 18, 2026
CVE-2026-1675: Advanced Country Blocker <= 2.3.1 Unauthenticated Authorization Bypass via Insecure Default Secret Key PoC, Patch Analysis & Rule
CVE-2026-1675 affects the Advanced Country Blocker plugin for WordPress (up to v2.3.1), allowing unauthenticated bypass of geolocation blocking. Update to v2.3.2 to mitigate this medium severity vulnerability (CVSS 5.3).
March 18, 2026
CVE-2025-13463: Bold Page Builder <= 5.5.3 Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid PoC, Patch Analysis & Rule
CVE-2025-13463 affects the Bold Page Builder plugin (up to version 5.5.3) with a CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure timely patching and consider WAF coverage.
March 18, 2026
CVE-2026-1613: Wonka Slide <= 1.3.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2026-1613 affects the Wonka Slide plugin for WordPress (up to version 1.3.3) with a medium severity CVSS score of 6.4. Ensure to patch against this stored XSS vulnerability to protect user data.
March 18, 2026
CVE-2025-12159: Bold Page Builder <= 5.4.8 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-12159 affects the Bold Page Builder plugin (up to v5.4.8) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.