AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-68895: AhaChat Messenger Marketing <= 1.1 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2025-68895 affects the AhaChat Messenger Marketing plugin for WordPress (up to v1.1) with a medium severity (CVSS 5.3) authentication bypass vulnerability. Users should update to the patched version to mitigate unauthorized access.
March 18, 2026
CVE-2025-68844: Membee Login <= 2.3.6 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68844 affects the Membees Member Login Widget (up to 2.3.6) with a high severity CVSS score of 7.2. Patch to version 2.3.7 to mitigate the stored XSS vulnerability that could compromise site security.
March 18, 2026
CVE-2026-1056: Snow Monkey Forms <= 12.0.3 Unauthenticated Arbitrary File Deletion via Path Traversal PoC, Patch Analysis & Rule
CVE-2026-1056 affects the Snow Monkey Forms plugin for WordPress (up to 12.0.3) with a critical CVSS score of 9.8. Patch to version 12.0.4 to mitigate the risk of unauthenticated file deletion vulnerabilities.
March 18, 2026
CVE-2025-14316: AhaChat Messenger Marketing <= 1.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-14316 affects the AhaChat Messenger Marketing plugin (v1.1) with a high severity CVSS score of 7.2. Unauthenticated stored XSS allows script injection; ensure you patch to mitigate risks.
March 18, 2026
CVE-2025-67977: HAPPY <= 1.0.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67977 affects the Happy Helpdesk Support Ticket System plugin (v1.0.8) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this missing capability check, so ensure you update to the patched version.
March 18, 2026
CVE-2026-1060: WP Adminify <= 4.0.7.7 Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API PoC, Patch Analysis & Rule
CVE-2026-1060 affects the Adminify plugin for WordPress, exposing sensitive information via an insecure REST API endpoint. Upgrade to version 4.0.7.8 to mitigate this medium-severity vulnerability.
March 18, 2026
CVE-2025-68855: JobBoard Job listing <= 1.2.8 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2025-68855 affects the Job Board Light plugin (up to v1.2.8) with a medium severity score of 5.3. Unauthenticated attackers can access sensitive data, so ensure timely patching or consider WAF solutions.
March 18, 2026
CVE-2025-68843: FeedWordPress Advanced Filters <= 0.6.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68843 affects the FeedWordPress Advanced Filters plugin (up to version 0.6.2) with a medium severity CVSS score of 6.1. Ensure you update to version 0.61 to mitigate the reflected cross-site scripting risk.
March 18, 2026
CVE-2025-68856: Mopinion Feedback Form <= 1.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68856 affects the Mopinion Feedback Form plugin for WordPress (up to v1.1.1) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability, highlighting the need for immediate...
March 18, 2026
CVE-2025-68847: iSape <= 0.72 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68847 affects the iSape plugin for WordPress (up to version 0.72) with a medium severity CVSS score of 6.1. Users should patch to mitigate reflected XSS risks from insufficient input sanitization.
March 18, 2026
CVE-2025-14039: Simple Folio <= 1.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields PoC, Patch Analysis & Rule
CVE-2025-14039 affects the Simple Folio plugin for WordPress (up to 1.1.1) with a medium severity CVSS of 6.4. Authenticated attackers can exploit this XSS vulnerability; update to version 1.1.2 to mitigate risks.
March 18, 2026
CVE-2026-1295: Buy Now Plus <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
CVE-2026-1295 affects the Buy Now Plus plugin (up to v1.0.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to v1.0.3 to mitigate risks from authenticated attackers injecting scripts.
March 18, 2026
CVE-2025-68531: ModelTheme Addons for WPBakery and Elementor < 1.5.6 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-68531 affects Modeltheme Addons for WPBakery versions up to 1.5.6, with a CVSS score of 7.5. Authenticated attackers can exploit a file upload vulnerability, risking data exposure and remote code execution. Patching is essential.
March 18, 2026
CVE-2025-69305: Crete Core <= 1.4.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-69305 affects the Crete Core WordPress plugin (up to version 1.4.3) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to extract sensitive database information. Patching...
March 18, 2026
CVE-2026-0702: VidShop – Shoppable Videos for WooCommerce <= 1.1.4 Unauthenticated Time-Based SQL Injection via 'fields' PoC, Patch Analysis & Rule
CVE-2026-0702 affects the Vidshop For WooCommerce plugin (up to version 1.1.4) with a high severity SQL injection vulnerability (CVSS 7.5). Update to version 1.1.5 to mitigate the risk of data extraction by attackers.
March 18, 2026
CVE-2025-68031: افزونه پیامک حرفه ای فراز اس ام اس <= 2.7.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68031 affects the Farazsms plugin for WordPress (up to version 2.7.3) with a CVSS score of 6.1. Users should patch to mitigate the reflected XSS vulnerability that allows attackers to inject scripts.
March 18, 2026
CVE-2025-68050: Leadpages <= 1.1.3 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-68050 affects the Leadpages plugin for WordPress (up to version 1.1.3) with a medium severity score of 5.3. Ensure to update to version 1.1.4 to mitigate unauthorized access risks.
March 18, 2026
CVE-2025-68846: Asynchronous Javascript <= 1.3.5 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68846 affects the Asynchronous Javascript plugin for WordPress (up to version 1.3.5) with a medium severity CVSS of 6.1. Users should patch to mitigate the risk of reflected XSS attacks.
March 18, 2026
CVE-2025-67972: Prague <= 2.2.8 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-67972 reveals a high severity XSS vulnerability in the Prague Plugins for WordPress (up to version 2.2.8). Unauthenticated attackers can inject scripts, impacting user security. Ensure to update to the patched version.
March 18, 2026
CVE-2025-14971: Link Invoice Payment for WooCommerce <= 2.8.0 Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation PoC, Patch Analysis & Rule
CVE-2025-14971 affects the Invoice Payment For WooCommerce plugin (up to v2.8.0) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized partial payment modifications. Update to v2.8.1 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.