AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-18
CVE-2025-14167: Remove Post Type Slug <= 1.0.2 – Cross-Site Request Forgery to Settings Update (remove-post-type-slug)
The Remove Post Type Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to incorrect nonce validation logic that uses OR (||) instead of AND (&&), causing the validation to fail when the nonce field is not empty OR when verification fails, rather…
2026-02-18
CVE-2026-2502: xmlrpc attacks blocker <= 1.0 – Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' (xmlrpc-attacks-blocker)
The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject…
2026-02-18
CVE-2025-14270: OneClick Chat to Order <= 1.0.9 – Missing Authorization to Authenticated (Editor+) Plugin Settings Update (oneclick-whatsapp-order)
The OneClick Chat to Order plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action in the wa_order_number_save_number_field function. This makes it possible for authenticated attackers, with Editor-level access and above, to…
2026-02-18
CVE-2025-14342: SEO Plugin by Squirrly SEO <= 12.4.14 – Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection (squirrly-seo)
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sq_ajax_uninstall function in all versions up to, and including, 12.4.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from Squirrly's cloud service.
2026-02-18
CVE-2025-14427: Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches <= 21.0.9 – Missing Authorization to Authenticated (Subscriber+) Email MFA Update (wp-simple-firewall)
The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including, 21.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the global…
2026-02-18
CVE-2026-0722: Shield Security <= 21.0.8 – Cross-Site Request Forgery to SQL Injection (wp-simple-firewall)
The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin allowing nonce verification to be bypassed via user-supplied parameter in the 'isNonceVerifyRequired' function. This makes it possible for unauthenticated attackers to execute SQL injection attacks, extracting sensitive information from…
2026-02-18
CVE-2025-13930: Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (woocommerce-checkout-manager)
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order ownership validation. This makes it possible for unauthenticated attackers…
2026-02-18
CVE-2026-0556: XO Event Calendar <= 3.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode (xo-event-calendar)
The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web…
2026-02-18
CVE-2025-4521: IDonate 2.1.5 – 2.1.9 – Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function (idonate)
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_profile() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack any account by reassigning its email address (via…
2026-02-18
CVE-2025-14851: YaMaps for WordPress <= 0.6.40 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters (yamaps)
The YaMaps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `yamap` shortcode parameters in all versions up to, and including, 0.6.40 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.