AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-06
CVE-2025-14835: WP Photo Album Plus <= 9.1.05.008 – Reflected Cross-Site Scripting (wp-photo-album-plus)
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick…
2026-01-06
CVE-2025-14468: AMP for WP – Accelerated Mobile Pages <= 1.1.9 – Cross-Site Request Forgery to Comment Submission (accelerated-mobile-pages)
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requests with VALID nonces and accepts requests with MISSING or INVALID nonces. This makes it possible…
2026-01-06
CVE-2025-14891: Customer Reviews for WooCommerce <= 5.93.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter (customer-reviews-woocommerce)
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will…
2026-01-06
CVE-2025-14901: Bit Form – Contact Form Plugin <= 2.21.6 – Missing Authorization to Unauthenticated Workflow Replay (bit-form)
The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verification where the security check only blocks requests when both the nonce verification…
2026-01-06
CVE-2025-14842: Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 – Unauthenticated Limited Arbitrary File Upload (drag-and-drop-multiple-file-upload-contact-form-7)
The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up to, and including, 1.3.9.2. This is due to the plugin not blocking .phar and .svg files. This makes it possible for unauthenticated attackers to upload arbitrary…
2026-01-06
CVE-2025-14845: NS IE Compatibility Fixer <= 2.1.5 – Cross-Site Request Forgery to Plugin Settings Update (ns-ie-compatibility-fixer)
The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick…
2026-01-06
CVE-2025-14888: Simple User Meta Editor <= 1.0.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field (simple-user-meta-editor)
The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will…
2026-01-06
CVE-2025-14887: twinklesmtp – Email Service Provider For WordPress <= 1.03 – Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings (twinklesmtp)
The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in…
2026-01-06
CVE-2025-13657: HelpDesk contact form plugin <= 1.1.5 – Cross-Site Request Forgery to Settings Update via handle_query_args (helpdesk-contact-form)
The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the handle_query_args() function. This makes it possible for unauthenticated attackers to update the plugin's license ID and contact form ID settings via a forged…
2026-01-06
CVE-2025-14875: HBLPAY Payment Gateway for WooCommerce <= 5.0.0 – Reflected Cross-Site Scripting via 'cusdata' Parameter (hblpay-payment-gateway-for-woocommerce)
The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.