AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14613: GetContentFromURL <= 1.0 Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute PoC, Patch Analysis & Rule
High CVE-2025-14613 in Getcontentfromurl (CVSS 7.2): GetContentFromURL. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14389: WPBlogSyn <= 1.0 Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update PoC, Patch Analysis & Rule
Medium CVE-2025-14389 in Wpblogsync (CVSS 4.3): WPBlogSyn. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0678: Shipping Rates by City for WooCommerce <= 1.0.3 Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0678 in Flat Shipping Rate By City For Woocommerce (CVSS 4.9): Shipping Rates by City for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15021: Gotham Block Extra Light <= 1.5.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
Medium CVE-2025-15021 in Gotham Block Extra Light (CVSS 4.4): Gotham Block Extra Light. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14482: Crush.pics Image Optimizer <= 1.8.7 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14482 in Crush Pics (CVSS 4.3): Crush.pics Image Optimizer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-12178: SpiceForms Form Builder <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-12178 in Spiceforms Form Builder (CVSS 6.4): SpiceForms Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0680: Real Post Slider Lite <= 2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PoC, Patch Analysis & Rule
Medium CVE-2026-0680 in Real Post Slider Lite (CVSS 4.4): Real Post Slider Lite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13627: Makesweat <= 0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting PoC, Patch Analysis & Rule
Medium CVE-2025-13627 in Makesweat (CVSS 4.4): Makesweat. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-14464: PDF Resume Parser <= 1.0 Unauthenticated Sensitive Information Disclosure in SMTP Credentials PoC, Patch Analysis & Rule
Medium CVE-2025-14464 in Pdf Resume Parser (CVSS 5.3): PDF Resume Parser. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0717: LottieFiles – Lottie block for Gutenberg <= 3.0.0 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-0717 in Lottiefiles (CVSS 5.3): LottieFiles – Lottie block for Gutenberg. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14725: Internal Link Builder <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings PoC, Patch Analysis & Rule
Medium CVE-2025-14725 in Internal Link Builder (CVSS 4.4): Internal Link Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0635: Responsive Accordion Slider <= 1.2.2 Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images' PoC, Patch Analysis & Rule
Medium CVE-2026-0635 in Responsive Accordion Slider (CVSS 4.3): Responsive Accordion Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0694: SearchWiz <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title PoC, Patch Analysis & Rule
Medium CVE-2026-0694 in Searchwiz (CVSS 6.4): SearchWiz. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-69098: Hide My WP <= 6.2.12 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-69098 in Hide_my_wp (CVSS 6.1): Hide My WP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14379: Testimonials Creator 1.6 Authenticated (Admin+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-14379 in Testimonials Creator (CVSS 4.4): Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-69001: FluentForm <= 6.1.11 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
Medium CVE-2025-69001 in Fluentform (CVSS 6.5): FluentForm. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.1.12.
March 18, 2026
CVE-2025-15486: Kunze Law <= 2.1 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-15486 in Kunze Law (CVSS 4.4): Kunze Law. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-69097: WPLMS <= 1.9.9.5.4 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
Critical CVE-2025-69097 in Wplms_plugin (CVSS 9.1): WPLMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14854: WP-CRM System – Manage Clients and Projects <= 3.4.5 Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14854 in Wp Crm System (CVSS 5.4): WP-CRM System – Manage Clients and Projects. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.4.6.
March 18, 2026
CVE-2025-69364: Breeze <= 2.2.21 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69364 in Breeze (CVSS 5.3): Breeze. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.2.22.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.