AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-13667: WP Recipe Manager <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field PoC, Patch Analysis & Rule
Medium CVE-2025-13667 in Wp Recipe Manager (CVSS 6.4): WP Recipe Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14999: Latest Tabs <= 1.5 Cross-Site Request Forgery to Plugin's Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14999 in Kento Latest Tabs (CVSS 4.3): Latest Tabs. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13531: Stylish Order Form Builder <= 1.0 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13531 in Stylish Order Form Builder (CVSS 6.4): Stylish Order Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-12540: ShareThis Dashboard for Google Analytics <= 3.2.4 Unauthenticated Google Analytics Data Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-12540 in Googleanalytics (CVSS 4.7): ShareThis Dashboard for Google Analytics. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-13529: Unify <= 3.4.9 Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13529 in Unify (CVSS 5.3): Unify. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.4.10.
March 18, 2026
CVE-2025-15018: Optional Email <= 1.3.11 Unauthenticated Privilege Escalation to Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2025-15018 in Optional Email (CVSS 9.8): Optional Email. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15158: WP Enable WebP <= 1.0 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2025-15158 in Wp Enable Webp (CVSS 8.8): WP Enable WebP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-15000: Page Keys <= 1.3.3 Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-15000 in Page Keys (CVSS 4.4): Page Keys. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.4.
March 18, 2026
CVE-2025-13521: WP Status Notifier <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-13521 in Wp Change Status Notifier (CVSS 4.3): WP Status Notifier. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-12030: ACF to REST API <= 3.3.4 Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification PoC, Patch Analysis & Rule
Medium CVE-2025-12030 in Acf To Rest Api (CVSS 4.3): ACF to REST API. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13527: xShare <= 1.0.1 Cross-Site Request Forgery to 'rs_plugin_reset' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13527 in Xshare (CVSS 4.3): xShare. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13519: SVG Map Plugin <= 1.0.0 Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13519 in Svg Map By Saedi (CVSS 6.1): SVG Map Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13493: Latest Registered Users <= 1.4 Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export PoC, Patch Analysis & Rule
High CVE-2025-13493 in Latest Registered Users (CVSS 7.5): Latest Registered Users. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13520: MTCaptcha WordPress Plugin <= 2.7.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-13520 in Mtcaptcha (CVSS 4.3): MTCaptcha WordPress Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13496: Moosend Landing Pages <= 1.1.6 Missing Authorization to Authenticated (Subscriber+) Option Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-13496 in Moosend Landing Pages (CVSS 5.3): Moosend Landing Pages. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-11877: User Activity Log <= 2.2 Unauthenticated Limited Options Update via Failed Login PoC, Patch Analysis & Rule
High CVE-2025-11877 in User Activity Log (CVSS 7.5): User Activity Log. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-13497: Recras WordPress plugin <= 6.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-13497 in Recras (CVSS 6.4): Recras WordPress plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.4.2.
March 18, 2026
CVE-2025-12958: Rankology SEO and Analytics Tool <= 2.0 Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation PoC, Patch Analysis & Rule
Low CVE-2025-12958 in Rankology Seo And Analytics Tool (CVSS 2.7): Rankology SEO and Analytics Tool. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.
March 18, 2026
CVE-2025-14802: LearnPress – WordPress LMS Plugin <= 4.3.2.2 Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-14802 in Learnpress (CVSS 5.4): LearnPress – WordPress LMS Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.2.2.
March 18, 2026
CVE-2025-12449: aBlocks – WordPress Gutenberg Blocks <= 2.4.0 Missing Authorization to Authenticated (Subscriber+) Settings Modification PoC, Patch Analysis & Rule
Medium CVE-2025-12449 in Ablocks (CVSS 5.4): aBlocks – WordPress Gutenberg Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.1.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.