AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
2026-01-27
CVE-2025-14316: AhaChat Messenger Marketing <= 1.1 – Unauthenticated Stored Cross-Site Scripting (ahachat-messenger-marketing)
The AhaChat Messenger Marketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-01-27
CVE-2026-1056: Snow Monkey Forms <= 12.0.3 – Unauthenticated Arbitrary File Deletion via Path Traversal (snow-monkey-forms)
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the…
2026-01-27
CVE-2025-68844: Membee Login <= 2.3.6 – Unauthenticated Stored Cross-Site Scripting (membees-member-login-widget)
The Membee Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-01-27
CVE-2025-68895: AhaChat Messenger Marketing <= 1.1 – Authentication Bypass (ahachat-messenger-marketing)
The AhaChat Messenger Marketing plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to bypass authentication and access other user's accounts.
2026-01-27
CVE-2025-68845: eDS Responsive Menu <= 1.2 – Reflected Cross-Site Scripting (eds-responsive-menu)
The eDS Responsive Menu plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
2026-01-27
CVE-2025-68880: Simple Archive Generator <= 5.2 – Reflected Cross-Site Scripting (simple-archive-generator)
The Simple Archive Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
2026-01-27
CVE-2025-67974: WPLegalPages <= 3.5.4 – Missing Authorization (wplegalpages)
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-01-27
CVE-2025-69297: Aardvark <= 2.19 – Missing Authorization (aardvark-plugin)
The Aardvark plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.19. This makes it possible for unauthenticated attackers to perform an unauthorized action.
2026-01-27
CVE-2025-67975: aDirectory <= 3.0.3 – Missing Authorization (adirectory)
The aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
2026-01-27
CVE-2025-69302: DesignThemes Core Features <= 2.3 – Reflected Cross-Site Scripting (designthemes-core-features)
The DesignThemes Core Features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action…
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.