AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-25399: Serious Slider <= 1.2.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25399 affects the Cryout Serious Slider plugin (up to v1.2.7) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Upgrade to v1.3.0 to mitigate this risk.
March 18, 2026
CVE-2025-14554: Sell BTC Cryptocurrency Selling Calculator <= 1.5 Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action PoC, Patch Analysis & Rule
CVE-2025-14554 affects the Sell BTC - Cryptocurrency Selling Calculator plugin (up to v1.5) with a CVSS score of 7.2. Unauthenticated attackers can exploit stored XSS. Upgrade to v1.6 to mitigate this risk.
March 18, 2026
CVE-2026-25391: WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25391 affects the Ai Content Generation plugin for WordPress (up to v1.3.07) with a medium severity CVSS of 4.3. Authenticated users can exploit this flaw, so ensure you update to the patched version.
March 18, 2026
CVE-2025-68042: Travelpayouts <= 1.2.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68042 affects the Travelpayouts WordPress plugin (up to v1.2.1) with a CVSS score of 4.3. It allows authenticated users to perform unauthorized actions. Upgrade to v1.2.2 to mitigate this risk.
March 18, 2026
CVE-2026-25021: Mizan Demo Importer <= 0.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25021 affects the Mizan Demo Importer plugin (up to version 0.1.3) with a medium severity CVSS score of 4.3. Patch to version 0.1.4 to mitigate unauthorized access risks.
March 18, 2026
CVE-2026-25020: WP Sync for Notion <= 1.7.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25020 affects the WP Sync for Notion plugin (up to v1.7.0) with a CVSS score of 4.3. Authenticated users can exploit this missing capability check, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-24383: B Slider <= 2.0.6 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24383 affects the B Slider plugin for WordPress (up to 2.0.6) with a medium severity CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, making patching to version 2.0.7 essential.
March 18, 2026
CVE-2026-25408: Broken Link Notifier <= 1.3.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25408 affects the Broken Link Notifier plugin (up to v1.3.5) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v1.3.6 to mitigate risks.
March 18, 2026
CVE-2026-25016: Nelio Popups <= 1.3.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25016 affects the Nelio Popups plugin (v1.3.5) with a medium severity score of 4.3. Authenticated users can exploit this flaw for unauthorized actions. Upgrade to v1.3.6 to mitigate risks.
March 18, 2026
CVE-2025-68005: Easy Hotel Booking <= 1.8.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68005 affects the Easy Hotel Booking plugin (up to v1.8.4) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized access. Upgrade to v1.8.5 to mitigate risks.
March 18, 2026
CVE-2026-25407: Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode <= 4.6.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25407 affects the Cookiebot plugin (up to v4.6.4) with a medium severity (CVSS 4.3) vulnerability allowing remote code execution. Update to v4.6.5 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68051: Shiprocket <= 2.0.8 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2025-68051 affects the Shiprocket plugin for WordPress (up to version 2.0.8) with a medium severity (CVSS 4.3) IDOR vulnerability. Authenticated users can exploit this flaw, so patching is essential to prevent unauthorized actions.
March 18, 2026
CVE-2026-22341: Booked <= 3.0.0 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2026-22341 is a critical authentication bypass in the Booked plugin for WordPress, with a CVSS score of 9.8. Users should upgrade from version 3.0.0 to mitigate the risk of account impersonation.
March 18, 2026
CVE-2026-25418: Bit Form <= 2.21.10 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-25418 affects the Bit Form plugin for WordPress (up to v2.21.10) with a medium severity score of 4.9. Admin-level users can exploit this SQL injection vulnerability, making timely patching essential for data protection.
March 18, 2026
CVE-2025-67978: Educare <= 1.6.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67978 affects the Educare WordPress plugin (up to 1.6.1) with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows attackers to inject scripts. Upgrade to version 1.6.2 to mitigate risks.
March 18, 2026
CVE-2025-68854: ID Arrays <= 2.1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68854 affects the Id Arrays plugin for WordPress (up to version 2.1.2) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Ensure to patch to mitigate potential script injection risks.
March 18, 2026
CVE-2026-24368: The Grid < 2.8.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24368 affects The Grid plugin for WordPress (up to version 2.8.0) with a CVSS score of 5.3. Unauthenticated attackers can exploit this missing capability check, so ensure you update to the patched version.
March 18, 2026
CVE-2026-25015: UsersWP <= 1.2.53 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-25015 affects the UsersWP plugin (up to version 1.2.53) with a medium severity CVSS score of 4.3. Patch to version 1.2.54 to mitigate a Cross-Site Request Forgery vulnerability that allows unauthorized banner uploads.
March 18, 2026
CVE-2026-25014: Enter Addons <= 2.3.2 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-25014 affects Enteraddons plugin versions up to 2.3.2, exposing a medium severity CSRF vulnerability. Upgrade to 2.3.3 to mitigate risks from unauthorized actions by attackers.
March 18, 2026
CVE-2025-67987: Quiz And Survey Master <= 10.3.1 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-67987 affects the Quiz Master Next plugin (up to v10.3.1) with a CVSS score of 6.5. This medium severity SQL injection allows authenticated users to extract sensitive data. Upgrade to v10.3.2 to mitigate.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.