AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2025-12002: Feeds for YouTube Pro <= 2.6.0 Unauthenticated Arbitrary File Read via Path Traversal PoC, Patch Analysis & Rule
CVE-2025-12002 affects the YouTube Feed Pro plugin (up to v2.6.0) with a medium severity (CVSS 5.9) file upload vulnerability. Ensure you update to the patched version to prevent unauthorized file access.
March 23, 2026
CVE-2025-12718: Quick Contact Form <= 8.2.6 Unauthenticated Open Mail Relay PoC, Patch Analysis & Rule
CVE-2025-12718 affects the Quick Contact Form plugin (up to version 8.2.6) with a medium severity CVSS of 5.8. Unauthenticated attackers can exploit it to send emails. Update to version 8.2.7 to mitigate.
March 23, 2026
CVE-2025-14075: WP Hotel Booking <= 2.2.7 Unauthenticated Sensitive Information Exposure via 'email' Parameter PoC, Patch Analysis & Rule
CVE-2025-14075 affects the WP Hotel Booking plugin (up to v2.2.7) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated access to sensitive customer information. Users should update to v2.2.8 to mitigate this risk.
March 23, 2026
CVE-2025-14632: Filr – Secure document library <= 1.2.11 Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload PoC, Patch Analysis & Rule
CVE-2025-14632 affects the Filr Protection plugin (up to v1.2.11) with a medium severity (CVSS 4.4) stored XSS vulnerability. Administrators should upgrade to v1.2.12 to mitigate risks from malicious file uploads.
March 23, 2026
CVE-2026-0682: Church Admin <= 5.0.28 Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter PoC, Patch Analysis & Rule
CVE-2026-0682 affects the Church Admin plugin (up to v5.0.28) with a low severity CVSS of 2.2. Authenticated admins can exploit this SSRF vulnerability, making it crucial to update to v5.0.29 to mitigate risks.
March 23, 2026
CVE-2025-67939: Tickera <= 3.5.6.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67939 affects the Tickera Event Ticketing System plugin (up to version 3.5.6.2) with a medium severity CVSS score of 4.3. Users should update to version 3.5.6.3 to mitigate unauthorized access risks.
March 23, 2026
CVE-2025-68008: Mail <= 1.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68008 affects the Wp Mail plugin (up to v1.3) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability, so ensure you update to the patched version.
March 23, 2026
CVE-2025-15403: RegistrationMagic <= 6.0.7.1 Privilege Escalation via admin_order PoC, Patch Analysis & Rule
CVE-2025-15403 affects the Custom Registration Form Builder With Submission Manager plugin (up to 6.0.7.1) with a critical CVSS score of 9.8. Update to 6.0.7.2 to mitigate unauthenticated privilege escalation risks.
March 23, 2026
CVE-2025-14450: Wallet System for WooCommerce <= 2.7.2 Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation PoC, Patch Analysis & Rule
CVE-2025-14450 affects the Wallet System for WooCommerce plugin (up to 2.7.2) with a CVSS score of 6.5. Authenticated users can exploit this medium-severity flaw to manipulate wallet balances. Upgrade to version 2.7.3 to mitigate risks.
March 23, 2026
CVE-2025-31413: Element Pack Elementor Addons <= 8.3.13 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-31413 affects Bdthemes Element Pack Lite plugin versions up to 8.3.13, with a medium severity (CVSS 4.3) CSRF vulnerability. Update to version 8.3.14 to mitigate unauthorized actions by attackers.
March 23, 2026
CVE-2026-24593: AWP Classifieds <= 4.4.3 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2026-24593 affects the Another Wordpress Classifieds Plugin versions up to 4.4.3, exposing sensitive data to unauthenticated attackers. Upgrade to version 4.4.4 to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2025-12825: User Registration Using Contact Form 7 <= 2.5 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
CVE-2025-12825 affects the User Registration Using Contact Form 7 plugin (up to v2.5) with a CVSS score of 5.3. Unauthenticated users can access sensitive data. Update to v2.6 to mitigate this risk.
March 23, 2026
CVE-2025-67942: Peach Payments Gateway <= 3.3.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-67942 affects the Wc Peach Payments Gateway plugin (up to version 3.3.6) with a medium severity CVSS score of 5.3. Update to version 3.3.7 to mitigate unauthorized access risks.
March 23, 2026
CVE-2025-12984: Advanced Ads – Ad Manager & AdSense <= 2.0.15 Authenticated (Admin+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-12984 affects the Advanced Ads plugin (up to v2.0.15) with a medium severity SQL injection vulnerability. Administrators should update to v2.0.16 to mitigate potential data exposure risks.
March 23, 2026
CVE-2026-25004: CM Business Directory – Optimise and showcase local business <= 1.5.3 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-25004 affects the CM Business Directory plugin for WordPress (up to version 1.5.3) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure to patch to mitigate risks from authenticated attackers.
March 23, 2026
CVE-2025-68849: Quote Master <= 7.1.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68849 affects the Quote Master plugin for WordPress (up to version 7.1.1) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 23, 2026
CVE-2026-24386: Element Invader – Template Kits for Elementor <= 1.2.4 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24386 affects the Element Invader plugin for WordPress (up to version 1.2.4) with a medium severity (CVSS 4.3). Ensure you update to the patched version to prevent unauthorized actions by low-privilege users.
March 23, 2026
CVE-2026-23800: Modular DS 2.5.2 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-23800 affects the Modular Connector plugin (v2.5.2) with a critical CVSS score of 9.8, allowing unauthenticated privilege escalation. Update to v2.6.0 to mitigate this risk.
March 23, 2026
CVE-2025-68871: Dooodl <= 2.3.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68871 affects the Dooodl WordPress plugin (up to version 2.3.0) with a CVSS score of 6.1. This medium severity XSS vulnerability allows unauthenticated attackers to inject scripts, emphasizing the need for patching.
March 23, 2026
CVE-2025-14478: Demo Importer Plus <= 2.0.9 Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload PoC, Patch Analysis & Rule
CVE-2025-14478 affects the Demo Importer Plus plugin (up to v2.0.9) with a high severity CVSS of 7.5. Authenticated attackers can exploit a file upload vulnerability for code execution. Update to v2.0.10 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.