AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-13139: SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 Cross-Site Request Forgery to Survey Creation PoC, Patch Analysis & Rule
CVE-2025-13139 affects the SurveyJS plugin (up to v2.5.2) with a CVSS score of 4.3. This medium severity CSRF vulnerability allows attackers to create surveys by tricking admins into clicking malicious links. Patching is essential.
March 18, 2026
CVE-2025-13194: SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 Cross-Site Request Forgery to Survey Renaming PoC, Patch Analysis & Rule
CVE-2025-13194 affects the SurveyJS plugin (up to version 2.5.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure to update to the patched version to prevent unauthorized survey renaming.
March 18, 2026
CVE-2026-1208: Friendly Functions for Welcart <= 1.2.5 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1208 affects the Friendly Functions For Welcart plugin (up to 1.2.5) with a medium severity CVSS score of 4.3. Update to version 1.2.6 to mitigate the Cross-Site Request Forgery risk.
March 18, 2026
CVE-2026-1127: Timeline Event History <= 3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-1127 affects the Timeline Event History plugin for WordPress (up to version 3.2) with a medium severity CVSS score of 6.1. Ensure to patch against this reflected XSS vulnerability to protect users from potential script injection.
March 18, 2026
CVE-2026-1189: LeadBI Plugin for WordPress <= 1.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1189 affects the Leadbi plugin for WordPress (up to v1.7) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, so patching is essential to secure your site.
March 18, 2026
CVE-2026-1266: Postalicious <= 3.0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2026-1266 affects the Postalicious plugin for WordPress (up to 3.0.1) with a CVSS score of 4.4. Admin-level attackers can exploit this stored XSS vulnerability, so ensure you patch to the latest version to mitigate risks.
March 18, 2026
CVE-2026-0800: User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 Unauthenticated Stored Cross-Site Scripting via Custom Field PoC, Patch Analysis & Rule
CVE-2026-0800 affects the User Submitted Posts plugin for WordPress, with a CVSS score of 7.2. Users should upgrade to version 20260110 to mitigate the high-severity stored XSS vulnerability.
March 18, 2026
CVE-2025-14907: Moderate Selected Posts <= 1.4 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14907 affects the Moderate Selected Posts plugin for WordPress (up to v1.4) with a CVSS score of 4.3. Unauthenticated attackers can exploit this CSRF vulnerability to modify settings if an admin is tricked into clicking a link.
March 18, 2026
CVE-2026-1191: JavaScript Notifier <= 1.2.8 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2026-1191 affects the Javascript Notifier plugin (up to v1.2.8) with a medium severity (CVSS 4.4) stored XSS vulnerability. Admins should patch to prevent script injection risks on user-accessed pages.
March 18, 2026
CVE-2026-0687: Meta-box GalleryMeta <= 3.0.1 Missing Authorization to Authenticated (Author+) Gallery Management PoC, Patch Analysis & Rule
CVE-2026-0687 affects the Meta Box GalleryMeta plugin (up to version 3.0.1) with a medium severity CVSS score of 4.3. Authenticated users can exploit this to modify data; update to version 3.1 to mitigate.
March 18, 2026
CVE-2026-0633: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 Unauthenticated Form Submission Exposure via Forgeable Cookie Value PoC, Patch Analysis & Rule
CVE-2026-0633 affects the Metform plugin (up to v4.1.0) with a CVSS score of 3.7, allowing unauthenticated access to sensitive form data. Update to v4.1.1 to mitigate this vulnerability.
March 18, 2026
CVE-2026-1302: Meta-box GalleryMeta <= 3.0.1 Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption PoC, Patch Analysis & Rule
CVE-2026-1302 affects the Meta Box Gallerymeta plugin (up to v3.0.1) with a medium severity (CVSS 4.4) XSS vulnerability. Patch to v3.1 to mitigate risks from authenticated attackers in multi-site setups.
March 18, 2026
CVE-2025-15516: All-in-One Video Gallery 4.1.0 4.6.4 Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update PoC, Patch Analysis & Rule
CVE-2025-15516 affects the All In One Video Gallery plugin (versions 4.1.0 to 4.6.4) with a CVSS score of 4.3. It allows authenticated users to modify user meta data. Update to version 4.7.1 to mitigate this risk.
March 18, 2026
CVE-2026-1098: CM CSS Columns <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1098 affects the CM CSS Columns plugin (up to 1.2.1) with a CVSS score of 6.4. This medium severity stored XSS vulnerability allows authenticated users to inject scripts. Users should update to the patched version to mitigate...
March 18, 2026
CVE-2025-14630: AdminQuickbar <= 1.9.3 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2025-14630 affects the AdminQuickbar plugin for WordPress (up to version 1.9.3) with a medium severity CVSS score of 4.3. Patching is essential to mitigate potential unauthorized changes to settings and post titles.
March 18, 2026
CVE-2026-1088: Login Page Editor <= 1.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1088 affects the Login Page Editor plugin for WordPress (up to v1.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to prevent unauthorized changes to login settings.
March 18, 2026
CVE-2026-1095: Canto Testimonials <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2026-1095 affects the Canto Testimonials plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated attackers can inject scripts, impacting user security. Ensure you update to the patched version.
March 18, 2026
CVE-2025-13676: JustClick registration plugin <= 0.1 Reflected Cross-Site Scripting via PHP_SELF PoC, Patch Analysis & Rule
CVE-2025-13676 affects the JustClick Subscriber plugin (version 0.1) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the risk of reflected cross-site scripting attacks.
March 18, 2026
CVE-2026-0806: WP-ClanWars <= 2.0.1 Authenticated (Administrator+) SQL Injection via 'orderby' Parameter PoC, Patch Analysis & Rule
CVE-2026-0806 affects the WP-ClanWars plugin (up to version 2.0.1) with a medium severity SQL injection vulnerability. Admin-level attackers can exploit this flaw to execute arbitrary SQL commands, highlighting the need for immediate...
March 18, 2026
CVE-2025-14843: Wizit Gateway for WooCommerce <= 1.2.9 Missing Authentication to Unauthenticated Arbitrary Order Cancellation PoC, Patch Analysis & Rule
CVE-2025-14843 affects the Wizit Gateway for WooCommerce plugin (up to v1.2.9) with a medium severity (CVSS 5.3) remote code execution vulnerability. Update to v1.3.0 to mitigate unauthorized order cancellations.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.