AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1244: Forms Bridge <= 4.2.5 Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1244 affects the Forms Bridge plugin (up to 4.2.5) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Update to version 4.3.0 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2025-8072: Target Video Easy Publish <= 3.8.8 Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter PoC, Patch Analysis & Rule
CVE-2025-8072 affects the Brid Video Easy Publish plugin (up to v3.8.8) with a medium severity CVSS score of 6.4. Authenticated users can exploit stored XSS vulnerabilities, so update to v3.8.9 to mitigate risks.
March 18, 2026
CVE-2026-1298: Easy Replace Image <= 3.5.2 Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement PoC, Patch Analysis & Rule
CVE-2026-1298 affects the Easy Replace Image plugin (up to 3.5.2) with a medium severity CVSS of 5.3. Authenticated users can replace images from external URLs, risking site defacement. Update to version 3.5.3 to mitigate.
March 18, 2026
CVE-2025-14610: TableMaster for Elementor <= 1.3.6 Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter PoC, Patch Analysis & Rule
CVE-2025-14610 affects Tablemaster for Elementor (up to 1.3.6) with a CVSS score of 7.2. Authenticated users can exploit SSRF to access sensitive files. Update to version 1.3.8 to mitigate this risk.
March 18, 2026
CVE-2025-69304: Allmart <= 1.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69304 affects the Allmart Core plugin (version 1.1) with a high severity CVSS score of 7.5. Unauthenticated SQL injection can lead to data extraction; users should update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-14865: Passster – Password Protect Pages and Content <= 4.2.24 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-14865 affects the Content Protector plugin for WordPress (up to version 4.2.24) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability; update to version 4.2.25 to mitigate risks.
March 18, 2026
CVE-2025-67973: Sunshine Photo Cart <= 3.5.6.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67973 affects the Sunshine Photo Cart plugin (up to v3.5.6.2) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v3.5.7.1 to mitigate risks of data manipulation and denial of service.
March 18, 2026
CVE-2026-0746: AI Engine <= 3.3.2 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-0746 affects the Ai Engine plugin for WordPress (up to v3.3.2) with a medium severity (CVSS 6.4) SSRF vulnerability. Update to v3.3.3 to mitigate risks from authenticated attackers making arbitrary web requests.
March 18, 2026
CVE-2025-68048: NextMove Lite <= 2.23.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68048 affects Woo Thank You Page Nextmove Lite (up to v2.23.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access. Update to v2.24.0 to mitigate this risk.
March 18, 2026
CVE-2025-68069: Directorist <= 8.5.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68069 affects the Directorist plugin (up to 8.5.8) with a medium severity CVSS score of 4.3. Authenticated attackers can exploit a missing capability check for unauthorized password resets. Update to 8.5.9 to mitigate this risk.
March 18, 2026
CVE-2025-68021: ConveyThis <= 269.1 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68021 affects the ConveyThis Translate plugin for WordPress (up to version 269.1) with a medium severity CVSS score of 5.3. Ensure you patch to prevent unauthorized access by unauthenticated attackers.
March 18, 2026
CVE-2025-14795: Stop Spammers Classic <= 2026.1 Cross-Site Request Forgery via Email Allowlist PoC, Patch Analysis & Rule
CVE-2025-14795 affects the Stop Spammer Registrations Plugin, with a CVSS score of 4.3. It allows unauthenticated attackers to exploit CSRF vulnerabilities. Ensure you update to the patched version to mitigate this risk.
March 18, 2026
CVE-2025-69323: Slimstat Analytics <= 5.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69323 affects the Slimstat Analytics plugin for WordPress (up to version 5.3.2) with a medium severity CVSS score of 6.1 due to reflected XSS. Update to version 5.3.3 to mitigate risks from potential attacks.
March 18, 2026
CVE-2025-68842: Widget Logic Visual <= 1.52 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68842 affects the Widget Logic Visual plugin (up to version 1.52) with a CVSS score of 6.1. Unauthenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-69302: DesignThemes Core Features <= 2.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69302 affects the DesignThemes Core Features plugin (up to v2.3) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the risk of reflected XSS attacks.
March 18, 2026
CVE-2025-67975: aDirectory <= 3.0.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67975 affects the aDirectory plugin (up to v3.0.3) with a CVSS score of 4.3. This medium severity vulnerability allows authenticated users to perform unauthorized actions. Upgrade to v3.0.4 to mitigate.
March 18, 2026
CVE-2025-69297: Aardvark <= 2.19 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69297 affects the Aardvark Plugin (up to version 2.19) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so ensure you update to the patched version to mitigate risks.
March 18, 2026
CVE-2025-67974: WPLegalPages <= 3.5.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67974 affects WP Legal Pages plugin versions up to 3.5.4, allowing unauthorized access due to a missing capability check. Upgrade to 3.5.5 to mitigate this medium severity vulnerability.
March 18, 2026
CVE-2025-68880: Simple Archive Generator <= 5.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68880 affects the Simple Archive Generator plugin for WordPress (up to version 5.2) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 18, 2026
CVE-2025-68845: eDS Responsive Menu <= 1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68845 affects the Eds Responsive Menu plugin for WordPress (up to version 1.2) with a CVSS score of 6.1. It allows unauthenticated attackers to exploit reflected XSS. Ensure you update to the patched version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.