AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14465: Sticky Action Buttons <= 1.1 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14465 in Sticky Action Buttons (CVSS 4.3): Sticky Action Buttons. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14118: Starred Review <= 1.4.2 Reflected Cross-Site Scripting via PHP_SELF Variable PoC, Patch Analysis & Rule
Medium CVE-2025-14118 in Starred Review (CVSS 6.1): Starred Review. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14070: Reviewify <= 1.0.7 Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation PoC, Patch Analysis & Rule
High CVE-2025-14070 in Review For Discount (CVSS 7.5): Reviewify. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.8.
March 18, 2026
CVE-2025-14147: Easy GitHub Gist Shortcodes <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-14147 in Easy Github Gist Shortcodes (CVSS 6.4): Easy GitHub Gist Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13801: Yoco Payments <= 3.9.0 Unauthenticated Arbitrary File Read PoC, Patch Analysis & Rule
High CVE-2025-13801 in Yoco Payment Gateway (CVSS 7.5): Yoco Payments. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.1.
March 18, 2026
CVE-2025-14130: Post Like Dislike <= 1.0 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
Medium CVE-2025-14130 in Post Like Dislike (CVSS 6.1): Post Like Dislike. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14121: EDD Download Info <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-14121 in Edd Download Info (CVSS 6.4): EDD Download Info. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14128: Stumble! for WordPress <= 1.1.1 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
Medium CVE-2025-14128 in Stumble For Wordpress (CVSS 6.1): Stumble! for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14131: WP Widget Changer <= 1.2.5 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
Medium CVE-2025-14131 in Wp Widget Changer (CVSS 6.1): WP Widget Changer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13694: AA Block country <= 1.0.1 Unauthenticated IP Address Spoofing via X-Forwarded-For Header PoC, Patch Analysis & Rule
Medium CVE-2025-13694 in Aa Block Country (CVSS 5.3): AA Block country. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-13841: Smart App Banners <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13841 in Smart App Banners (CVSS 6.4): Smart App Banners. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-13887: AI BotKit <= 1.1.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13887 in Ai Botkit For Lead Generation (CVSS 6.4): AI BotKit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.8.
March 18, 2026
CVE-2025-14460: Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 Missing Authorization to Unauthenticated Arbitrary Order Status Change PoC, Patch Analysis & Rule
Medium CVE-2025-14460 in Woo Payment Gateway For Piraeus Bank (CVSS 5.3): Piraeus Bank WooCommerce Payment Gateway. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14028: Contact Us Simple Form <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
Medium CVE-2025-14028 in Contact Us Simple Form (CVSS 4.4): Contact Us Simple Form. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13419: Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 Missing Authorization to Unauthenticated Media Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-13419 in Front Editor (CVSS 5.3): Guest posting / Frontend Posting / Front Editor – WP Front User Submit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.1.
March 18, 2026
CVE-2025-14144: Mstoic Shortcodes <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-14144 in Mstoic Shortcodes (CVSS 6.4): Mstoic Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14114: 1180px Shortcodes <= 1.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-14114 in 1180px Shortcodes (CVSS 6.4): 1180px Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13990: Mamurjor Employee Info <= 1.0.0 Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation PoC, Patch Analysis & Rule
Medium CVE-2025-13990 in Mamurjor Employee Info (CVSS 4.3): Mamurjor Employee Info. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14110: WP Js List Pages Shortcodes <= 1.21 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-14110 in Wp Js List Pages Shortcodes (CVSS 6.4): WP Js List Pages Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13847: PhotoFade <= 0.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13847 in Photofade (CVSS 6.4): PhotoFade. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.