AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-02-06
CVE-2025-15476: The Bucketlister <= 0.1.5 – Missing Authorization to Authenticated (Subscriber+) Bucket List Modification (the-bucketlister)
The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_ajax() function in all versions up to, and including, 0.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add delete or modify arbitrary bucket list items.
2026-02-05
CVE-2025-68025: Addonify Floating Cart For WooCommerce <= 1.2.17 – Missing Authorization (addonify-floating-cart)
The Addonify Floating Cart For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.17. This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-02-05
CVE-2025-68863: iContact for Gravity Forms <= 1.3.2 – Reflected Cross-Site Scripting (gravity-forms-icontact)
The iContact for Gravity Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an…
2026-02-05
CVE-2025-69375: Portfolio Builder <= 1.2.5 – Unauthenticated Local File Inclusion (swp-portfolio)
The Portfolio Builder plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive…
2026-02-05
CVE-2025-68851: Okay Toolkit <= 2.3 – Reflected Cross-Site Scripting (okay-toolkit)
The Okay Toolkit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such…
2026-02-05
CVE-2025-68862: Woo File Dropzone <= 1.1.7 – Authenticated (Subscriber+) Arbitrary File Deletion (woo-file-dropzone)
The Woo File Dropzone plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when…
2026-02-05
CVE-2026-1401: Tune Library <= 1.6.3 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import (tune-library)
The Tune Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSV import in all versions up to, and including, 1.6.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in…
2026-02-05
CVE-2025-68032: Advanced WC Analytics <= 3.19.0 – Missing Authorization to Unauthenticated Settings Update (advance-wc-analytics)
The AWCA – The Great Analytics Insights for Your eStore plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.19.0. This makes it possible for unauthenticated attackers to update plugin settings.
2026-02-05
CVE-2025-68852: Court Reservation <= 1.10.8 – Reflected Cross-Site Scripting (court-reservation)
The Court Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.10.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such…
2026-02-05
CVE-2026-25028: ElementInvader Addons for Elementor <= 1.4.1 – Missing Authorization (elementinvader-addons-for-elementor)
The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.