AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-06
CVE-2025-14845: NS IE Compatibility Fixer <= 2.1.5 – Cross-Site Request Forgery to Plugin Settings Update (ns-ie-compatibility-fixer)
The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick…
2026-01-06
CVE-2025-14888: Simple User Meta Editor <= 1.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field (simple-user-meta-editor)
The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will…
2026-01-06
CVE-2025-14887: twinklesmtp – Email Service Provider For WordPress <= 1.03 – Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings (twinklesmtp)
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in…
2026-01-06
CVE-2025-13657: HelpDesk contact form plugin <= 1.1.5 – Cross-Site Request Forgery to Settings Update via handle_query_args (helpdesk-contact-form)
The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the handle_query_args() function. This makes it possible for unauthenticated attackers to update the plugin's license ID and contact form ID settings via a forged…
2026-01-06
CVE-2025-14875: HBLPAY Payment Gateway for WooCommerce <= 5.0.0 – Reflected Cross-Site Scripting via 'cusdata' Parameter (hblpay-payment-gateway-for-woocommerce)
The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully…
2026-01-06
CVE-2025-14867: Flashcard Plugin for WordPress <= 0.9 – Authenticated (Contributor+) Arbitrary File Read via Path Traversal (flashcard)
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
2026-01-06
CVE-2025-14370: Quote Comments <= 3.0.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update (quote-comments)
The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter.
2026-01-06
CVE-2025-14904: Newsletter Email Subscribe <= 2.4 – Cross-Site Request Forgery to Plugin Settings Update (newsletter-email-subscribe)
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing…
2026-01-06
CVE-2025-13371: Money Space <= 2.13.9 – Unauthenticated Sensitive Information Exposure (money-space)
The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin storing full payment card details (PAN, card holder name, expiry month/year, and CVV) in WordPress post_meta using base64_encode(), and then embedding these values into the publicly accessible mspaylink page's inline…
2026-01-06
CVE-2025-13369: Premmerce WooCommerce Customers Manager <= 1.1.14 – Reflected Cross-Site Scripting (woo-customers-manager)
The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.