AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-14792: Key Figures <= 1.1 Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render PoC, Patch Analysis & Rule
Medium CVE-2025-14792 in Key Figures (CVSS 4.4): Key Figures. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13369: Premmerce WooCommerce Customers Manager <= 1.1.14 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13369 in Woo Customers Manager (CVSS 6.1): Premmerce WooCommerce Customers Manager. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.15.
March 18, 2026
CVE-2025-13371: Money Space <= 2.13.9 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
High CVE-2025-13371 in Money Space (CVSS 8.6): Money Space. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14904: Newsletter Email Subscribe <= 2.4 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14904 in Newsletter Email Subscribe (CVSS 4.3): Newsletter Email Subscribe. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14370: Quote Comments <= 3.0.0 Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14370 in Quote Comments (CVSS 5.3): Quote Comments. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14867: Flashcard Plugin for WordPress <= 0.9 Authenticated (Contributor+) Arbitrary File Read via Path Traversal PoC, Patch Analysis & Rule
Medium CVE-2025-14867 in Flashcard (CVSS 6.5): Flashcard Plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14875: HBLPAY Payment Gateway for WooCommerce <= 5.0.0 Reflected Cross-Site Scripting via 'cusdata' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-14875 in Hblpay Payment Gateway For Woocommerce (CVSS 6.1): HBLPAY Payment Gateway for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13657: HelpDesk contact form plugin <= 1.1.5 Cross-Site Request Forgery to Settings Update via handle_query_args PoC, Patch Analysis & Rule
Medium CVE-2025-13657 in Helpdesk Contact Form (CVSS 4.3): HelpDesk contact form plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.6.
March 18, 2026
CVE-2025-14887: twinklesmtp – Email Service Provider For WordPress <= 1.03 Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings PoC, Patch Analysis & Rule
Medium CVE-2025-14887 in Twinklesmtp (CVSS 4.4): twinklesmtp – Email Service Provider For WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14888: Simple User Meta Editor <= 1.0.0 Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field PoC, Patch Analysis & Rule
Medium CVE-2025-14888 in Simple User Meta Editor (CVSS 4.4): Simple User Meta Editor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14845: NS IE Compatibility Fixer <= 2.1.5 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14845 in Ns Ie Compatibility Fixer (CVSS 4.3): NS IE Compatibility Fixer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14842: Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 Unauthenticated Limited Arbitrary File Upload PoC, Patch Analysis & Rule
Medium CVE-2025-14842 in Drag And Drop Multiple File Upload Contact Form 7 (CVSS 6.1): Drag and Drop Multiple File Upload – Contact Form 7. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
March 18, 2026
CVE-2025-14901: Bit Form – Contact Form Plugin <= 2.21.6 Missing Authorization to Unauthenticated Workflow Replay PoC, Patch Analysis & Rule
Medium CVE-2025-14901 in Bit Form (CVSS 6.5): Bit Form – Contact Form Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14891: Customer Reviews for WooCommerce <= 5.93.1 Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-14891 in Customer Reviews Woocommerce (CVSS 6.4): Customer Reviews for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.94.0.
March 18, 2026
CVE-2025-14468: AMP for WP – Accelerated Mobile Pages <= 1.1.9 Cross-Site Request Forgery to Comment Submission PoC, Patch Analysis & Rule
Medium CVE-2025-14468 in Accelerated Mobile Pages (CVSS 4.3): AMP for WP – Accelerated Mobile Pages. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.10.
March 18, 2026
CVE-2025-14835: WP Photo Album Plus <= 9.1.05.008 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-14835 in Wp Photo Album Plus (CVSS 7.1): WP Photo Album Plus. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14059: EmailKit <= 1.6.1 Authenticated (Author+) Arbitrary File Read via Path Traversal PoC, Patch Analysis & Rule
Medium CVE-2025-14059 in Emailkit (CVSS 6.5): EmailKit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.2.
March 18, 2026
CVE-2026-0656: iPaymu Payment Gateway for WooCommerce <= 2.0.2 Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure PoC, Patch Analysis & Rule
High CVE-2026-0656 in Ipaymu For Woocommerce (CVSS 8.2): iPaymu Payment Gateway for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.3.
March 18, 2026
CVE-2025-67931: BulletProof Security <= 6.9 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-67931 in Bulletproof Security (CVSS 5.3): BulletProof Security. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.0.
March 18, 2026
CVE-2025-69348: The Events Calendar Countdown Addon <= 1.4.15 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-69348 in Countdown For The Events Calendar (CVSS 4.3): The Events Calendar Countdown Addon. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.16.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.