AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-69355: Tickera <= 3.5.6.4 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69355 in Tickera Event Ticketing System (CVSS 4.3): Tickera. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.5.6.5.
March 18, 2026
CVE-2025-13393: Featured Image from URL (FIFU) <= 5.3.1 Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' PoC, Patch Analysis & Rule
Medium CVE-2025-13393 in Featured Image From Url (CVSS 4.3): Featured Image from URL (FIFU). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.2.
March 18, 2026
CVE-2026-24965: Contest Gallery <= 28.1.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24965 in Contest Gallery (CVSS 4.3): Contest Gallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-69352: The Events Calendar <= 6.15.12.2 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69352 in The Events Calendar (CVSS 4.3): The Events Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.15.13.
March 18, 2026
CVE-2025-14948: miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 Missing Authorization to Unauthenticated Notification Settings Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14948 in Miniorange Sms Order Notification Otp Verification (CVSS 5.3): miniOrange OTP Verification and SMS Notification for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-69354: Better Business Reviews <= 0.1.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69354 in Better Business Reviews (CVSS 4.3): Better Business Reviews. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.1.2.
March 18, 2026
CVE-2026-24366: YITH WooCommerce Request A Quote <= 2.46.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24366 in Yith Woocommerce Request A Quote (CVSS 5.3): YITH WooCommerce Request A Quote. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.46.1.
March 18, 2026
CVE-2025-14172: WP Page Permalink Extension <= 1.5.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush PoC, Patch Analysis & Rule
Medium CVE-2025-14172 in Change Wp Page Permalinks (CVSS 6.5): WP Page Permalink Extension. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13701: Shabat Keeper <= 0.4.4 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
Medium CVE-2025-13701 in Shabat Keeper (CVSS 6.1): Shabat Keeper. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13903: PullQuote <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13903 in Pullquote (CVSS 6.4): PullQuote. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13967: Woodpecker for WordPress <= 3.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-13967 in Woodpecker (CVSS 6.4): Woodpecker for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14555: Countdown Timer Widget Countdown <= 2.7.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-14555 in Widget Countdown (CVSS 6.4): Countdown Timer - Widget Countdown. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.7.8.
March 18, 2026
CVE-2025-14506: ConvertForce Popup Builder <= 0.0.7 Stored Cross-Site Scripting via entrance_animation PoC, Patch Analysis & Rule
Medium CVE-2025-14506 in Convertforce Popup Builder (CVSS 6.4): ConvertForce Popup Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.0.8.
March 18, 2026
CVE-2025-13704: Autogen Headers Menu <= 1.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13704 in Autogen Headers Menu (CVSS 6.4): Autogen Headers Menu. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13893: Lesson Plan Book <= 1.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13893 in Lesson Plan Book (CVSS 6.1): Lesson Plan Book. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13854: Curved Text <= 0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13854 in Curved Text (CVSS 6.4): Curved Text. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13897: Client Testimonial Slider <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field PoC, Patch Analysis & Rule
Medium CVE-2025-13897 in Wp Client Testimonial (CVSS 6.4): Client Testimonial Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13717: Contact Form vCard Generator <= 2.4 Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13717 in Contact Form Vcard Generator (CVSS 5.3): Contact Form vCard Generator. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13892: MG AdvancedOptions <= 1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13892 in Mg Advancedoptions (CVSS 6.1): MG AdvancedOptions. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13895: Top Position Google Finance <= 0.1.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13895 in Top Position Google Finance (CVSS 6.1): Top Position Google Finance. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.