AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2025-63020: Postie <= 1.9.73 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-63020 affects the Postie plugin for WordPress (up to version 1.9.73) with a medium severity CVSS score of 6.4. Patch to version 1.9.74 to mitigate the stored XSS vulnerability.
March 23, 2026
CVE-2025-62144: Core Web Vitals & PageSpeed Booster <= 1.0.27 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-62144 affects the Core Web Vitals Pagespeed Booster plugin (up to v1.0.27) with a medium severity (CVSS 4.3). Ensure you update to v1.0.28 to mitigate unauthorized access risks.
March 23, 2026
CVE-2025-59136: Gerencianet Oficial <= 3.1.3 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
CVE-2025-59136 affects the Woo Gerencianet Official plugin (up to version 3.1.3) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive data, highlighting the need for immediate patching.
March 23, 2026
CVE-2025-66154: Couponer for Elementor <= 1.1.7 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66154 affects the Couponer Elementor plugin (up to v1.1.7) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this flaw for unauthorized actions, so ensure timely patching.
March 23, 2026
CVE-2025-68885: Custom Post Status <= 1.1.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-68885 affects the Custom Post Status plugin for WordPress (up to v1.1.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Ensure you update to the patched version to mitigate unauthorized actions.
March 23, 2026
CVE-2025-66144: Worker for Elementor <= 1.0.10 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-66144 affects the Worker Elementor plugin (up to v1.0.10) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can exploit this flaw for unauthorized actions; ensure timely patching to mitigate risks.
March 23, 2026
CVE-2025-49339: Direct Payments WP <= 1.3.0 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-49339 affects the Direct Payments WP plugin (up to v1.3.0) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions by authenticated users. Update to v1.3.1 to mitigate this risk.
March 23, 2026
CVE-2025-49340: Direct Payments WP <= 1.3.0 Authenticated (Subscriber+) Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-49340 affects the Direct Payments WP plugin (up to v1.3.0) with a CVSS score of 4.3. Authenticated users can access sensitive data. Update to v1.3.1 to mitigate this vulnerability.
March 23, 2026
CVE-2025-10734: ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2025-10734 affects the ReviewX plugin (up to v2.2.12) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated attackers to access sensitive user data. Upgrade to v2.3.0 to mitigate this risk.
March 23, 2026
CVE-2025-10736: ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation PoC, Patch Analysis & Rule
CVE-2025-10736 affects the ReviewX plugin (up to version 2.2.10) with a CVSS score of 6.5. This medium severity flaw allows unauthorized access to sensitive data. Update to version 2.2.12 to mitigate risks.
March 23, 2026
CVE-2026-4373: JetFormBuilder <= 3.5.6.2 Unauthenticated Arbitrary File Read via Media Field PoC, Patch Analysis & Rule
CVE-2026-4373 affects JetFormBuilder plugin version 3.5.6.2 with a CVSS score of 7.5. Unauthenticated attackers can exploit a file upload vulnerability to exfiltrate local files. Upgrade to version 3.5.6.3 to mitigate this risk.
March 23, 2026
CVE-2025-6229: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` PoC, Patch Analysis & Rule
CVE-2025-6229 affects the Sina Extension for Elementor plugin (up to version 3.7.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Patch to version 3.7.1 to mitigate risks from authenticated attackers.
March 23, 2026
CVE-2025-10731: ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 Unauthenticated Sensitive Information Exposure to Data Export PoC, Patch Analysis & Rule
CVE-2025-10731 affects the ReviewX plugin for WordPress (up to version 2.2.12) with a medium severity score of 5.3. Unauthenticated attackers can exploit this vulnerability to access sensitive data; update to version 2.3.0 to mitigate.
March 23, 2026
CVE-2026-3427: Yoast SEO <= 27.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute PoC, Patch Analysis & Rule
CVE-2026-3427 affects the Yoast SEO plugin (up to version 27.1.1) with a medium severity CVSS score of 6.4. Authenticated attackers can exploit this XSS vulnerability, so update to version 27.2 to mitigate risks.
March 23, 2026
CVE-2025-10679: ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 Unauthenticated Limited Remote Code Execution PoC, Patch Analysis & Rule
CVE-2025-10679 affects the ReviewX plugin for WordPress (up to version 2.2.12) with a CVSS score of 7.3. This high-severity vulnerability allows unauthenticated remote code execution. Update to version 2.3.0 to mitigate risks.
March 23, 2026
CVE-2026-4314: The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module PoC, Patch Analysis & Rule
CVE-2026-4314 affects the Wpextended plugin (up to version 3.2.4) with a CVSS score of 8.8. Authenticated users can escalate privileges to admin. Update to version 3.2.5 to mitigate this high-severity vulnerability.
March 23, 2026
CVE-2026-2580: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 Unauthenticated SQL Injection via 'orderby' Parameter PoC, Patch Analysis & Rule
CVE-2026-2580 affects the WP Google Map Plugin (up to v4.9.1) with a high severity CVSS score of 7.5. Unauthenticated SQL injection can expose sensitive data; update to v4.9.2 to mitigate risks.
March 23, 2026
CVE-2026-3629: Import and export users and customers <= 1.29.7 Privilege Escalation to Administrator via save_extra_user_profile_fields PoC, Patch Analysis & Rule
CVE-2026-3629 affects the Import Users From Csv With Meta plugin (up to v1.29.7) with a CVSS score of 8.1. Unauthenticated attackers can escalate privileges to admin if specific settings are enabled. Update to v2.0 to mitigate.
March 23, 2026
CVE-2025-14037: Invelity Products Feeds <= 1.2.6 Cross-Site Request Forgery to Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-14037 affects the Invelity Products Feeds plugin (up to v1.2.6) with a high severity CVSS score of 8.1. It allows authenticated attackers to delete files via CSRF. Patching is essential to mitigate this risk.
March 23, 2026
CVE-2024-13785: Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 Unauthenticated Blind Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2024-13785 affects the ARForms Form Builder plugin (up to version 1.7.2) with a medium severity CVSS score of 5.6, allowing remote code execution. Update to the patched version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.