AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2026-0691: CM E-Mail Blacklist <= 1.6.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter PoC, Patch Analysis & Rule
CVE-2026-0691 affects the CM Email Blacklist plugin (up to version 1.6.2) with a medium severity CVSS score of 4.4. Authenticated attackers can exploit stored XSS vulnerabilities, making prompt patching essential.
March 23, 2026
CVE-2025-10484: Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2025-10484 affects the Registration Login With Mobile Phone Number plugin (v1.3.1) with a critical CVSS score of 9.8. Unauthenticated attackers can bypass authentication, compromising user accounts. Immediate patching is essential.
March 23, 2026
CVE-2025-68872: Eli’s WordCents adSense Widget with Analytics <= 1.3.03.27 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68872 affects the Wordcents plugin (up to 1.3.03.27) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate potential script injection attacks.
March 23, 2026
CVE-2025-68016: onepay Payment Gateway For WooCommerce <= 1.1.2 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
CVE-2025-68016 affects the Onepay Payment Gateway for WooCommerce plugin (up to v1.1.2) with a medium severity CVSS score of 5.3. Unauthenticated attackers can modify order statuses; update to v1.1.3 to mitigate.
March 23, 2026
CVE-2025-15491: Post Slides <= 1.0.1 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-15491 affects the Post Slides plugin for WordPress (v1.0.1 and earlier) with a high severity CVSS score of 7.5. Unauthenticated attackers can exploit this local file inclusion vulnerability, so patching is essential.
March 23, 2026
CVE-2026-1087: The Guardian News Feed <= 1.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
CVE-2026-1087 affects The Guardian News Feed plugin (up to v1.2) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can alter settings, including the API key, by tricking admins. Ensure you update to the...
March 23, 2026
CVE-2025-14844: Membership Plugin – Restrict Content <= 3.2.16 Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-14844 affects the Restrict Content plugin (up to v3.2.16) with a CVSS score of 8.2. Unauthenticated attackers can leak sensitive Stripe client secrets. Update to v3.2.17 to mitigate this high-severity vulnerability.
March 23, 2026
CVE-2025-68859: Syntax Highlighter Compress <= 3.0.83.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68859 affects the Syntax Highlighter Compress plugin (up to v3.0.83.3) with a medium severity CVSS score of 6.1. Unauthenticated attackers can exploit this reflected XSS vulnerability, making timely patching essential.
March 23, 2026
CVE-2025-68883: bidorbuy Store Integrator <= 2.12.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68883 affects the Bidorbuystoreintegrator plugin (up to 2.12.0) with a medium severity (CVSS 6.1) reflected XSS vulnerability. Users should update to the patched version to mitigate potential exploitation.
March 23, 2026
CVE-2025-68017: Antideo Email Validator <= 1.0.10 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2025-68017 affects the Antideo Email Validator plugin (versions up to 1.0.10) with a high severity SQL injection vulnerability (CVSS 7.5). Users should patch immediately to prevent unauthorized database access.
March 23, 2026
CVE-2026-24591: Turn Yoast SEO FAQ Block to Accordion <= 1.0.6 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24591 affects the Turn Yoast SEO FAQ Block to Accordion plugin (up to v1.0.6) with a medium severity CVSS score of 6.4. Authenticated users can exploit this XSS vulnerability, so patching is essential.
March 23, 2026
CVE-2025-14757: Cost Calculator Builder <= 3.6.9 Missing Authorization to Unauthenticated Payment Status Bypass PoC, Patch Analysis & Rule
CVE-2025-14757 affects the Cost Calculator Builder plugin for WordPress (up to version 3.6.9) with a CVSS score of 5.3. It allows unauthenticated users to mark payments as completed. Update to version 3.6.10 to mitigate this risk.
March 23, 2026
CVE-2026-1004: Essential Addons for Elementor <= 6.5.5 Missing Authorization to Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2026-1004 affects the Essential Addons for Elementor Lite plugin (up to v6.5.5), allowing unauthenticated access to sensitive WooCommerce product info. Upgrade to v6.5.6 to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2025-14853: LEAV Last Email Address Validator <= 1.7.1 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14853 affects the Last Email Address Validator plugin for WordPress (versions
March 23, 2026
CVE-2025-14375: RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 Reflected Cross-Site Scripting via className PoC, Patch Analysis & Rule
CVE-2025-14375 affects the Wp Rss Aggregator plugin (up to 5.0.10) with a medium severity (CVSS 6.1) cross-site scripting vulnerability. Update to version 5.0.11 to mitigate risks from potential script injections.
March 23, 2026
CVE-2026-0939: Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 Unauthenticated Order Status Manipulation PoC, Patch Analysis & Rule
CVE-2026-0939 affects the Woo Rede plugin for WordPress (up to 5.1.2) with a CVSS score of 5.3. Unauthenticated attackers can manipulate order statuses; update to version 5.1.3 to mitigate this vulnerability.
March 23, 2026
CVE-2025-14793: DK PDF – WordPress PDF Generator <= 2.3.0 Authenticated (Author+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2025-14793 affects the Dk Pdf plugin (up to v2.3.0) with a medium severity (CVSS 5.0) SSRF vulnerability. Authenticated users can exploit this flaw, so update to v2.3.1 to mitigate risks.
March 23, 2026
CVE-2026-0942: Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 Missing Authorization to Unauthenticated Rede Order Logs Deletion PoC, Patch Analysis & Rule
CVE-2026-0942 affects the Woo Rede plugin (up to 5.1.5) with a CVSS score of 5.3. It allows unauthenticated users to delete order logs. Update to version 5.1.6 to mitigate this remote code execution risk.
March 23, 2026
CVE-2026-0916: Related Posts by Taxonomy <= 2.7.6 Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode PoC, Patch Analysis & Rule
CVE-2026-0916 affects the Related Posts By Taxonomy plugin (up to 2.7.6) with a medium severity (CVSS 6.4) stored XSS vulnerability. Update to version 2.7.7 to mitigate risks from authenticated attacks.
March 23, 2026
CVE-2025-12957: All-in-One Video Gallery <= 4.5.7 Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass PoC, Patch Analysis & Rule
CVE-2025-12957 affects the All In One Video Gallery plugin (up to v4.5.7) with a high severity CVSS of 8.8. Authenticated users can exploit a file upload vulnerability, so update to v4.6.4 to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.