AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69324: NEX-Forms <= 9.1.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69324 affects the NEX-Forms plugin for WordPress (up to version 9.1.7) with a high severity CVSS score of 7.2. Users should upgrade to version 9.1.8 to mitigate the stored XSS vulnerability.
March 18, 2026
CVE-2025-67984: NPS computy <= 2.8.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67984 affects the NPS Computy plugin for WordPress (up to version 2.8.2) with a high severity CVSS score of 7.2 due to stored XSS. Update to version 2.8.3 to mitigate risks from this vulnerability.
March 18, 2026
CVE-2026-1268: Dynamic Widget Content <= 1.3.6 Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field PoC, Patch Analysis & Rule
CVE-2026-1268 affects the Dynamic Widget Content plugin (up to v1.3.6) with a CVSS score of 6.4. Authenticated attackers can exploit this stored XSS vulnerability. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-23976: Modula Image Gallery <= 2.13.4 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-23976 affects the Modula Best Grid Gallery plugin (up to v2.13.4) with a medium severity CVSS of 6.4 due to stored XSS. Update to v2.13.5 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2025-67979: WPForms Google Sheet Connector <= 4.0.1 Authenticated (Subscriber+) Remote Code Execution PoC, Patch Analysis & Rule
CVE-2025-67979 affects the GSheetConnector for WPForms plugin (versions
March 18, 2026
CVE-2026-1319: Robin Image Optimizer <= 2.0.2 Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field PoC, Patch Analysis & Rule
CVE-2026-1319 affects the Robin Image Optimizer plugin (up to version 2.0.2) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit stored XSS via the 'Alternative Text' field. Upgrade to version 2.0.3 to mitigate.
March 18, 2026
CVE-2025-68853: Contact Manager <= 9.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-68853 affects the Contact Manager plugin for WordPress (up to version 9.1) with a high severity CVSS score of 8.1. Patch to version 9.1.1 to mitigate the risk of unauthenticated PHP Object Injection.
March 18, 2026
CVE-2025-68841: TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-68841 affects the Topper Pack plugin for WordPress (up to v1.2.1) with a CVSS score of 8.1. This high-severity Local File Inclusion vulnerability allows unauthenticated attackers to execute arbitrary PHP code. Update to the...
March 18, 2026
CVE-2025-68023: Addonify – Compare Products For WooCommerce <= 1.1.17 Missing Authorization to Unauthenticated Settings Update PoC, Patch Analysis & Rule
CVE-2025-68023 affects the Addonify Compare Products plugin (up to v1.1.17) with a medium severity (CVSS 5.3) remote code execution vulnerability. Update to v1.1.18 to mitigate unauthorized access to plugin settings.
March 18, 2026
CVE-2026-24988: The Events Calendar Shortcode & Block <= 3.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24988 affects The Events Calendar Shortcode plugin (up to v3.1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability; update to v3.1.2 to mitigate risks.
March 18, 2026
CVE-2025-68024: Addonify – WooCommerce Wishlist <= 2.0.15 Missing Authorization to Unauthenticated Settings Update PoC, Patch Analysis & Rule
CVE-2025-68024 affects the Addonify Wishlist plugin (up to v2.0.15) with a medium severity (CVSS 5.3) remote code execution flaw. Users should update to v2.0.16 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68834: Sync Master Sheet – Product Sync with Google Sheet for WooCommerce <= 1.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68834 affects the Product Sync Master Sheet plugin for WordPress (up to version 1.1.3) with a medium severity CVSS score of 5.3. Patch to version 1.1.4 to mitigate unauthorized remote code execution risks.
March 18, 2026
CVE-2025-68022: Plugin BlueX for WooCommerce <= 3.1.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68022 affects the BlueX for WooCommerce plugin (up to version 3.1.4) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this remote code execution vulnerability, so update to the patched version.
March 18, 2026
CVE-2026-0679: Fortis for WooCommerce <= 1.2.0 Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint PoC, Patch Analysis & Rule
CVE-2026-0679 affects the Fortis for WooCommerce plugin (up to version 1.2.0) with a medium severity (CVSS 5.3) authentication bypass vulnerability. Update to version 1.3.0 to mitigate unauthorized order status changes.
March 18, 2026
CVE-2025-15487: Code Explorer <= 1.4.6 Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter PoC, Patch Analysis & Rule
CVE-2025-15487 affects the Code Explorer plugin for WordPress (up to 1.4.6) with a medium severity CVSS score of 4.9. Authenticated attackers can exploit a path traversal vulnerability to read sensitive server files. Update to the...
March 18, 2026
CVE-2025-15260: MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification PoC, Patch Analysis & Rule
CVE-2025-15260 affects the Woorewards plugin (up to v5.6.1) with a medium severity (CVSS 6.5) vulnerability. Authenticated users can exploit this flaw to modify loyalty program rules. Patch immediately to mitigate risks.
March 18, 2026
CVE-2026-0816: All push notification for WP <= 1.5.3 Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter PoC, Patch Analysis & Rule
CVE-2026-0816 affects the All Push Notification plugin for WordPress (up to v1.5.3) with a medium severity (CVSS 4.9) SQL injection vulnerability. Admins should patch to prevent data extraction risks.
March 18, 2026
CVE-2025-15268: Infility Global <= 2.14.46 Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass PoC, Patch Analysis & Rule
CVE-2025-15268 affects the Infility Global plugin for WordPress (up to version 2.14.46) with a high severity SQL injection vulnerability (CVSS 7.5). Patching is essential to prevent unauthorized database access.
March 18, 2026
CVE-2025-15368: SportsPress <= 2.7.26 Authenticated (Contributor+) Local File Inclusion via Shortcode PoC, Patch Analysis & Rule
CVE-2025-15368 affects the SportsPress plugin (up to version 2.7.26) with a high severity CVSS score of 8.8. Authenticated attackers can exploit this authentication bypass to execute arbitrary PHP code. Update to version 2.7.27 to mitigate.
March 18, 2026
CVE-2026-0742: Smart Appointment & Booking <= 1.0.7 Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action PoC, Patch Analysis & Rule
CVE-2026-0742 affects the Smart Appointment Booking plugin (up to version 1.0.7) with a medium severity CVSS score of 6.4. Users should upgrade to version 1.0.8 to mitigate the stored XSS vulnerability.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.