AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-13900: WP Popup Magic <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-13900 in Wppopupmagic (CVSS 6.4): WP Popup Magic. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13908: The Tooltip <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13908 in The Tooltip (CVSS 6.4): The Tooltip. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13852: Debt.com Business in a Box <= 4.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13852 in Debtcom Business In A Box (CVSS 6.4): Debt.com Business in a Box. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13862: Menu Card <= 0.8.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13862 in Menu Card (CVSS 6.4): Menu Card. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13853: Nearby Now Reviews <= 5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13853 in Nearby Now Reviews (CVSS 6.4): Nearby Now Reviews. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14146: Booking Calendar <= 10.14.10 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-14146 in Booking (CVSS 5.3): Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 10.14.11.
March 18, 2026
CVE-2025-13729: Entry Views <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-13729 in Entry Views (CVSS 6.4): Entry Views. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13753: WP Table Builder <= 2.0.19 Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation PoC, Patch Analysis & Rule
Medium CVE-2025-13753 in Wp Table Builder (CVSS 4.3): WP Table Builder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.0.20.
March 18, 2026
CVE-2025-14937: Frontend Admin by DynamiApps <= 3.28.23 Unauthenticated Stored Cross-Site Scripting via 'update_field' PoC, Patch Analysis & Rule
High CVE-2025-14937 in Acf Frontend Form Element (CVSS 7.2): Frontend Admin by DynamiApps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.28.24.
March 18, 2026
CVE-2025-13935: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion PoC, Patch Analysis & Rule
Medium CVE-2025-13935 in Tutor (CVSS 4.3): Tutor LMS – eLearning and online course solution. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.4.
March 18, 2026
CVE-2026-0627: AMP for WP <= 1.1.10 Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload PoC, Patch Analysis & Rule
Medium CVE-2026-0627 in Accelerated Mobile Pages (CVSS 6.4): AMP for WP. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.11.
March 18, 2026
CVE-2025-14657: Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' PoC, Patch Analysis & Rule
High CVE-2025-14657 in Wp Event Solution (CVSS 7.2): Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-14741: Frontend Admin by DynamiApps <= 3.28.25 Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element PoC, Patch Analysis & Rule
Critical CVE-2025-14741 in Acf Frontend Form Element (CVSS 9.1): Frontend Admin by DynamiApps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13628: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification PoC, Patch Analysis & Rule
Medium CVE-2025-13628 in Tutor (CVSS 4.3): Tutor LMS – eLearning and online course solution. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.4.
March 18, 2026
CVE-2025-14980: BetterDocs <= 4.3.3 Authenticated (Contributor+) Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-14980 in Betterdocs (CVSS 6.5): BetterDocs. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.3.4.
March 18, 2026
CVE-2025-15057: SlimStat Analytics <= 5.3.3 Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter PoC, Patch Analysis & Rule
High CVE-2025-15057 in Wp Slimstat (CVSS 7.2): SlimStat Analytics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.4.
March 18, 2026
CVE-2026-0563: WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0563 in Wp Google Street View (CVSS 6.4): WP Google Street View (with 360° virtual tour) & Google maps + Local SEO. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.9.
March 18, 2026
CVE-2025-13934: Tutor LMS – eLearning and online course solution <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass PoC, Patch Analysis & Rule
Medium CVE-2025-13934 in Tutor (CVSS 4.3): Tutor LMS – eLearning and online course solution. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.4.
March 18, 2026
CVE-2025-15019: BIALTY Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-15019 in Bulk Image Alt Text With Yoast (CVSS 6.4): BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-15055: SlimStat Analytics <= 5.3.4 Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters PoC, Patch Analysis & Rule
High CVE-2025-15055 in Wp Slimstat (CVSS 7.2): SlimStat Analytics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.5.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.