AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24380: EventPrime <= 4.2.8.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24380 affects the Eventprime Event Calendar Management plugin (up to version 4.2.8.0) with a medium severity CVSS score of 5.3. Patch to 4.2.8.1 to prevent unauthorized access and protect your site.
March 18, 2026
CVE-2026-25411: Revision Manager TMC <= 2.8.22 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-25411 affects the Revision Manager Tmc plugin for WordPress (up to version 2.8.22) with a medium severity CVSS score of 4.3. Ensure proper nonce validation to mitigate Cross-Site Request Forgery risks.
March 18, 2026
CVE-2026-25422: Popularis Extra <= 1.2.10 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-25422 affects the Popularis Extra plugin for WordPress (up to 1.2.10) with a medium severity (CVSS 4.3) CSRF vulnerability. Upgrade to version 1.4.1 to mitigate the risk of unauthorized actions by unauthenticated users.
March 18, 2026
CVE-2026-24357: Recipe Maker <= 10.2.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24357 affects WP Recipe Maker plugin versions up to 10.2.4, allowing unauthorized actions by authenticated users. Upgrade to version 10.3.0 to mitigate this medium severity vulnerability (CVSS 4.3).
March 18, 2026
CVE-2025-69310: Woodly Core <= 1.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69310 affects the Woodly Core plugin for WordPress (up to v1.4) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to access sensitive database information. Patching is...
March 18, 2026
CVE-2025-69308: Nestbyte Core <= 1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69308 affects the Nestbyte Core plugin for WordPress (up to v1.2) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to access sensitive database information. Patching is...
March 18, 2026
CVE-2026-25416: News Kit Addons For Elementor <= 1.4.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25416 affects the News Kit Elementor Addons plugin (up to v1.4.2) with a CVSS score of 4.3. Authenticated users can exploit this to perform unauthorized actions. Ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-68564: Sendy <= 3.4.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68564 affects the Sendy WordPress plugin (up to version 3.4.1) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Upgrade to version 3.4.2 to mitigate this risk.
March 18, 2026
CVE-2025-69306: Electio Core <= 1.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69306 affects the Electio Core plugin for WordPress (up to version 1.4) with a high severity score of 7.5. Unauthenticated SQL injection can lead to unauthorized data extraction; users should patch immediately.
March 18, 2026
CVE-2026-25410: WP-CORS <= 0.2.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25410 affects the WP-CORS plugin (up to version 0.2.2) with a medium severity (CVSS 4.3) flaw allowing unauthorized actions by low-privilege users. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-69303: ModelTheme Framework <= 1.9.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69303 affects the Modeltheme Framework plugin for WordPress (up to v1.9.2) with a medium severity (CVSS 5.3). Unauthenticated attackers can exploit this vulnerability, so patching is essential.
March 18, 2026
CVE-2025-69307: Medinik Core <= 1.3.6 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69307 affects the Medinik Core plugin for WordPress (up to v1.3.6) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to extract sensitive database information. Patching is...
March 18, 2026
CVE-2025-69309: Saasplate Core <= 1.2.8 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69309 affects the Saasplate Core plugin for WordPress (up to version 1.2.8) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows attackers to extract sensitive data. Users should update to the patched...
March 18, 2026
CVE-2026-25419: UpsellWP <= 2.2.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25419 affects the Checkout Upsell And Order Bumps plugin (up to v2.2.3) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Upgrade to v2.2.5 to mitigate risks.
March 18, 2026
CVE-2025-69365: Uroan Core <= 1.4.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69365 affects the Uroan Core plugin for WordPress (up to version 1.4.4) with a high severity CVSS score of 7.5 due to SQL injection. Ensure to patch to prevent unauthorized database access.
March 18, 2026
CVE-2025-69366: Emerce Core <= 1.8 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69366 affects the Emerce Core plugin for WordPress (up to version 1.8) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to extract sensitive database information...
March 18, 2026
CVE-2026-1280: Frontend File Manager Plugin <= 23.5 Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter PoC, Patch Analysis & Rule
CVE-2026-1280 affects Nmedia User File Uploader (up to v23.5) with a high severity CVSS score of 7.5. Unauthenticated attackers can exploit this file upload vulnerability to share sensitive files via email. Update to v23.6.
March 18, 2026
CVE-2026-25409: JAMstack Deployments <= 1.1.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-25409 affects the Wp Jamstack Deployments plugin (v1.1.1) with a medium severity CVSS score of 4.3. Authenticated users can exploit a missing capability check, making patching essential to prevent unauthorized actions.
March 18, 2026
CVE-2026-1380: Bitcoin Donate Button <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1380 affects the Bitcoin Donate Button plugin for WordPress (v1.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can alter settings if an admin is tricked into a malicious action. Patching is...
March 18, 2026
CVE-2026-1391: Vzaar Media Management <= 1.2 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
CVE-2026-1391 affects the Vzaar Media Management plugin for WordPress (up to version 1.2) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this XSS vulnerability, making timely patching essential.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.