AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-67990: GMap Targeting <= 1.1.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67990 affects the Gmap Targeting plugin for WordPress (up to version 1.1.7) with a CVSS score of 7.2. Users should update to the patched version to mitigate the high-risk stored XSS vulnerability.
March 18, 2026
CVE-2025-68043: LottieFiles <= 3.0.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68043 affects the Lottiefiles plugin for WordPress (up to 3.0.0), with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this vulnerability, so ensure you update to the patched version.
March 18, 2026
CVE-2026-25028: ElementInvader Addons for Elementor <= 1.4.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25028 affects the ElementInvader Addons for Elementor plugin (up to version 1.4.1) with a CVSS score of 4.3. Authenticated users can exploit this medium-severity flaw, so update to version 1.4.2 to mitigate risks.
March 18, 2026
CVE-2025-68852: Court Reservation <= 1.10.8 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68852 affects the Court Reservation plugin for WordPress (up to 1.10.8) with a medium severity CVSS score of 6.1 due to reflected XSS. Update to version 1.10.9 to mitigate this vulnerability.
March 18, 2026
CVE-2025-68032: Advanced WC Analytics <= 3.19.0 Missing Authorization to Unauthenticated Settings Update PoC, Patch Analysis & Rule
CVE-2025-68032 affects the Advanced WC Analytics plugin (up to version 3.19.0), allowing unauthorized access to settings. With a CVSS score of 4.3, users should update to the patched version to mitigate this medium-severity risk.
March 18, 2026
CVE-2026-1401: Tune Library <= 1.6.3 Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import PoC, Patch Analysis & Rule
CVE-2026-1401 affects the Tune Library plugin for WordPress (up to 1.6.3) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to version 1.6.4 to mitigate risks from malicious script injections.
March 18, 2026
CVE-2025-68862: Woo File Dropzone <= 1.1.7 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-68862 affects the Woo File Dropzone plugin (up to v1.1.7) with a CVSS score of 4.3. Authenticated users can exploit a file upload vulnerability to delete critical files. Patching is essential to mitigate risks.
March 18, 2026
CVE-2025-68851: Okay Toolkit <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68851 affects the Okay Toolkit plugin for WordPress (up to version 2.3) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2025-69375: Portfolio Builder <= 1.2.5 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-69375 affects the Swp Portfolio plugin (up to v1.2.5) with a high severity CVSS score of 8.1. This authentication bypass vulnerability allows unauthenticated attackers to execute arbitrary PHP code. Patching is essential.
March 18, 2026
CVE-2025-68863: iContact for Gravity Forms <= 1.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68863 affects the iContact for Gravity Forms plugin (up to version 1.3.2) with a medium severity CVSS score of 6.1. Ensure to patch to mitigate the reflected XSS risk from untrusted input.
March 18, 2026
CVE-2025-68025: Addonify Floating Cart For WooCommerce <= 1.2.17 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68025 affects the Addonify Floating Cart plugin for WordPress (v1.2.17 and below) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this remote code execution flaw, so patching is essential.
March 18, 2026
CVE-2026-1294: All In One Image Viewer Block <= 1.0.2 Unauthenticated Server-Side Request Forgery via image-proxy Endpoint PoC, Patch Analysis & Rule
CVE-2026-1294 affects the All In One Image Viewer Block plugin (up to 1.0.2) with a high severity CVSS score of 7.2 due to an SSRF vulnerability. Users should upgrade to version 1.0.3 to mitigate potential unauthorized access.
March 18, 2026
CVE-2025-13416: ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension PoC, Patch Analysis & Rule
CVE-2025-13416 affects the ProfileGrid User Profiles plugin (up to 5.9.7.2) with a CVSS score of 4.3. Authenticated users can suspend others, including admins. Update to 5.9.7.3 to mitigate this risk.
March 18, 2026
CVE-2026-1654: Peter’s Date Countdown <= 2.0.0 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2026-1654 affects the Peters Date Countdown plugin (up to v2.0.0) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should patch to mitigate potential script injection risks.
March 18, 2026
CVE-2026-1271: ProfileGrid <= 5.9.7.2 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification PoC, Patch Analysis & Rule
CVE-2026-1271 affects the ProfileGrid User Profiles plugin (up to version 5.9.7.2) with a medium severity (CVSS 5.3). Authenticated users can change any profile image. Update to 5.9.7.3 to mitigate this risk.
March 18, 2026
CVE-2025-14079: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 Missing Authorization to Authenticated (Subscriber+) Settings Update PoC, Patch Analysis & Rule
CVE-2025-14079 affects the Elex Helpdesk Customer Support Ticket System plugin (up to 3.3.5) with a medium severity CVSS score of 5.3. Authenticated users can modify settings; update to version 3.3.6 to mitigate.
March 18, 2026
CVE-2025-13192: Popup builder with Gamification <= 2.2.0 Unauthenticated SQL Injection via Multiple REST API Endpoints PoC, Patch Analysis & Rule
CVE-2025-13192 affects the Popup Builder Block plugin (up to v2.2.0) with a high severity SQL injection vulnerability (CVSS 8.2). Update to v2.2.1 to mitigate risks of unauthorized data exposure.
March 18, 2026
CVE-2026-1246: ShortPixel Image Optimizer <= 6.4.2 Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter PoC, Patch Analysis & Rule
CVE-2026-1246 affects the ShortPixel Image Optimizer plugin (up to version 6.4.2) with a medium severity (CVSS 4.9) file upload vulnerability. Update to 6.4.3 to mitigate risks of unauthorized file access.
March 18, 2026
CVE-2025-68037: Export Media URLs <= 2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68037 affects the Export Media URLs plugin for WordPress (up to version 2.2) with a medium severity CVSS score of 6.1. Ensure you update to version 2.3 to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2026-0867: Essential Widgets <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes PoC, Patch Analysis & Rule
CVE-2026-0867 affects the Essential Widgets plugin for WordPress (up to version 3.0) with a medium severity XSS vulnerability. Users should upgrade to version 3.0.1 to mitigate risks from authenticated attackers.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.