AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14782: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 Missing Authorization to Authenticated (Forminator User+) CSV Export PoC, Patch Analysis & Rule
Medium CVE-2025-14782 in Forminator (CVSS 5.3): Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.49.2.
March 18, 2026
CVE-2025-14893: IndieWeb <= 4.0.5 Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-14893 in Indieweb (CVSS 6.4): IndieWeb. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.0.
March 18, 2026
CVE-2025-14736: Frontend Admin by DynamiApps <= 3.28.29 Unauthenticated Privilege Escalation to Administrator via Role Form Field PoC, Patch Analysis & Rule
Critical CVE-2025-14736 in Acf Frontend Form Element (CVSS 9.8): Frontend Admin by DynamiApps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.28.30.
March 18, 2026
CVE-2025-14886: Japanized for WooCommerce <= 2.7.17 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14886 in Woocommerce For Japan (CVSS 5.3): Japanized for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.8.0.
March 18, 2026
CVE-2025-13749: Clearfy <= 2.4.0 Cross-Site Request Forgery to Update Notification Tampering PoC, Patch Analysis & Rule
Medium CVE-2025-13749 in Clearfy (CVSS 4.3): Clearfy. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.1.
March 18, 2026
CVE-2025-14718: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 Missing Authorization to Authenticated (Contributor+) Workflow Manipulation PoC, Patch Analysis & Rule
Medium CVE-2025-14718 in Post Expirator (CVSS 5.4): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-14436: Brevo for WooCommerce <= 4.0.49 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-14436 in Woocommerce Sendinblue Newsletter Subscription (CVSS 7.2): Brevo for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.50.
March 18, 2026
CVE-2025-14720: Booking for Appointments and Events Calendar – Amelia <= 1.2.38 Missing Authorization to Unauthenticated Multiple AJAX Actions PoC, Patch Analysis & Rule
Medium CVE-2025-14720 in Ameliabooking (CVSS 5.3): Booking for Appointments and Events Calendar – Amelia. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.
March 18, 2026
CVE-2025-14574: weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-14574 in Wedocs (CVSS 5.3): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.1.16.
March 18, 2026
CVE-2026-24358: Quiz And Survey Master <= 10.3.3 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24358 in Quiz Master Next (CVSS 4.3): Quiz And Survey Master. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 10.3.4.
March 18, 2026
CVE-2026-24353: User Registration <= 4.4.9 Authenticated (Subscriber+) Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
Medium CVE-2026-24353 in User Registration (CVSS 5.4): User Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.
March 18, 2026
CVE-2025-66533: GiveWP <= 4.13.1 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
Medium CVE-2025-66533 in Give (CVSS 6.5): GiveWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.13.2.
March 18, 2026
CVE-2025-22715: Attractive Donations System Easy Stripe & Paypal donations <= 1.25 Missing Authorization to Unauthenticated Arbitrary Content Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-22715 in WP_AttractiveDonationsSystem (CVSS 5.3): Attractive Donations System - Easy Stripe & Paypal donations. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-27090: Kenta Companion <= 1.3.3 Cross-Site Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2026-27090 in Kenta Companion (CVSS 4.3): Kenta Companion. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-22726: nK Themes Helper <= 1.7.9 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2025-22726 in Nk Themes Helper (CVSS 6.4): nK Themes Helper. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-24387: WP Quick Post Duplicator <= 2.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24387 in Wp Quick Post Duplicator (CVSS 4.3): WP Quick Post Duplicator. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.2.
March 18, 2026
CVE-2025-22728: Workreap (theme’s plugin) <= 3.3.6 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2025-22728 in Workreap (CVSS 6.5): Workreap (theme's plugin). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-49055: Lead Capturing Pages <= 2.5 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-49055 in Wp Lead Capture (CVSS 7.5): Lead Capturing Pages. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-50005: tagDiv Composer <= 5.4.2 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-50005 in Td Composer (CVSS 6.4): tagDiv Composer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-22725: Virtual Assistant <= 3.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-22725 in VirtualAssistant (CVSS 7.2): Virtual Assistant. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.