AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2025-68041: Omnichannel for WooCommerce <= 1.3.65 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68041 affects the Codistoconnect plugin for WordPress (up to version 1.3.65) with a CVSS score of 7.2. Unauthenticated attackers can exploit this high-severity XSS vulnerability, so ensure you patch to the latest version.
March 23, 2026
CVE-2026-24598: Multilanguage by BestWebSoft <= 1.5.2 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24598 affects the Multilanguage plugin for WordPress (up to version 1.5.2) with a medium severity CVSS score of 4.3. Patching is crucial as it allows authenticated users to perform unauthorized actions.
March 23, 2026
CVE-2026-24388: WPMasterToolKit <= 2.14.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24388 affects the WPMasterToolKit plugin (up to v2.14.0), allowing authenticated users to perform unauthorized actions. Update to v2.14.1 to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2025-69101: Workreap Core <= 3.4.0 Authentication Bypass PoC, Patch Analysis & Rule
CVE-2025-69101 affects the Workreap Core plugin for WordPress (up to 3.4.0) with a critical CVSS score of 9.8. Unauthenticated attackers can bypass authentication, making immediate patching essential.
March 23, 2026
CVE-2025-69102: Test Email <= 1.1.7 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69102 affects the Wp Test Email plugin (up to v1.1.7) with a medium severity CVSS score of 6.1 due to reflected cross-site scripting. Users should patch immediately to mitigate potential client-side code execution.
March 23, 2026
CVE-2026-22334: Woocommerce Book Price <= 1.3 Authenticated (Subscriber++) Arbitrary File Download PoC, Patch Analysis & Rule
CVE-2026-22334 affects the Woo Book Price plugin (up to version 1.3) with a medium severity CVSS score of 6.5. Authenticated users can exploit a path traversal vulnerability to access sensitive server files. Patching is recommended.
March 23, 2026
CVE-2025-68898: Synergy Project Manager <= 1.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68898 affects the Synergy Project Manager plugin for WordPress (up to version 1.5) with a CVSS score of 7.2. Unauthenticated attackers can exploit this XSS vulnerability, so ensure you update to the patched version.
March 23, 2026
CVE-2025-14457: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 Missing Authorization to Unauthenticated File Deletion PoC, Patch Analysis & Rule
CVE-2025-14457 affects the Drag And Drop Multiple File Upload Contact Form 7 plugin (up to v1.3.9.2), allowing unauthenticated users to delete files. Update to v1.3.9.3 to mitigate this low-severity vulnerability.
March 23, 2026
CVE-2026-24361: LearnPress – Course Review <= 4.1.9 Authenticated (Learnpress student+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24361 affects the LearnPress Course Review plugin (up to v4.1.9) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to v4.2.0 to mitigate risks from authenticated attacks.
March 23, 2026
CVE-2025-68001: g-FFL Checkout <= 2.1.0 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
The g-FFL Checkout plugin for WordPress (up to version 2.1.0) has a critical file upload vulnerability (CVE-2025-68001) with a CVSS score of 9.8. Upgrade to version 2.1.1 to mitigate the risk of remote code execution.
March 23, 2026
CVE-2025-14448: WP-Members Membership Plugin <= 3.5.4.3 Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields PoC, Patch Analysis & Rule
CVE-2025-14448 affects the WP-Members plugin (up to 3.5.4.3) with a medium severity CVSS score of 5.4. Authenticated users can exploit this XSS vulnerability, so update to version 3.5.4.4 to mitigate risks.
March 23, 2026
CVE-2026-24602: Raptive Ads <= 3.10.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24602 affects the Adthrive Ads plugin (up to version 3.10.0) with a medium severity score of 5.3. Unauthenticated attackers can exploit this vulnerability, so update to version 3.11.0 to mitigate risks.
March 23, 2026
CVE-2026-24603: Universal Google Adsense and Ads manager <= 1.1.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24603 affects the Universal Google Adsense and Ads Manager plugin (up to version 1.1.8), allowing unauthorized access due to missing capability checks. Users should patch to mitigate this medium severity vulnerability.
March 23, 2026
CVE-2025-12166: Simply Schedule Appointments <= 1.6.9.9 Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters PoC, Patch Analysis & Rule
CVE-2025-12166 affects the Simply Schedule Appointments plugin (up to 1.6.9.9) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated access to sensitive data. Update to 1.6.9.13 to mitigate.
March 23, 2026
CVE-2026-24604: Simple GDPR Cookie Compliance <= 2.0.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24604 affects the Simple GDPR Cookie Compliance plugin (up to v2.0.0) with a medium severity CVSS score of 5.3. Unauthenticated attackers can exploit this flaw, so update to v2.0.1 to mitigate risks.
March 23, 2026
CVE-2026-24605: X Addons for Elementor <= 1.0.23 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24605 affects the X Addons Elementor plugin (up to version 1.0.23) with a medium severity (CVSS 4.3). Authenticated users can exploit a missing capability check to perform unauthorized actions. Update to the patched version.
March 23, 2026
CVE-2026-24601: Penci Pay Writer <= 1.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24601 affects the Penci Pay Writer plugin (up to version 1.5) with a medium severity (CVSS 6.4) stored XSS vulnerability. Ensure you update to the patched version to mitigate potential script injection risks.
March 23, 2026
CVE-2026-24600: Penci Review <= 3.5 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24600 affects the Penci Review plugin for WordPress (up to version 3.5) with a medium severity CVSS score of 6.4 due to stored cross-site scripting. Users should update to the patched version to mitigate potential attacks.
March 23, 2026
CVE-2025-15513: Float Payment Gateway <= 1.1.9 Improper Authorization to Unauthenticated Order Status Manipulation PoC, Patch Analysis & Rule
CVE-2025-15513 affects the Float Gateway plugin for WordPress (up to 1.1.9) with a CVSS score of 5.3. This medium severity flaw allows unauthenticated users to mark WooCommerce orders as failed. Update to 1.1.10 to mitigate.
March 23, 2026
CVE-2026-23550: Modular DS <= 2.5.1 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
CVE-2026-23550 affects the Modular Connector plugin (up to v2.5.1) with a critical CVSS score of 9.8. Unauthenticated attackers can gain admin access due to a broken oAuth implementation. Update to v2.5.2 to mitigate this risk.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.