AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 23, 2026
CVE-2025-13997: King Addons for Elementor <= 51.1.49 Unauthenticated API Keys Disclosure PoC, Patch Analysis & Rule
CVE-2025-13997 affects King Addons for Elementor (up to v51.1.49) with a medium severity (CVSS 5.3) vulnerability allowing unauthenticated API key disclosure. Update to v51.1.51 to mitigate risks.
March 18, 2026
CVE-2026-0739: WMF Mobile Redirector <= 1.2 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters PoC, Patch Analysis & Rule
CVE-2026-0739 affects the Wmf Mobile Redirector plugin (v1.2) with a CVSS score of 4.4. This medium-severity stored XSS vulnerability allows admin users to inject scripts. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-0812: LinkedIn SC <= 1.1.9 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page PoC, Patch Analysis & Rule
CVE-2026-0812 affects the LinkedIn SC plugin for WordPress (up to version 1.1.9) with a medium severity CVSS score of 4.4. Admins should patch to prevent stored XSS attacks that can compromise user sessions.
March 18, 2026
CVE-2025-14846: SocialChamp with WordPress <= 1.3.5 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14846 affects the Auto Post To Social Media Wp To Social Champ plugin (up to version 1.3.5) with a medium severity CVSS score of 4.3. Update to version 1.3.6 to mitigate the Cross-Site Request Forgery risk.
March 18, 2026
CVE-2026-0594: List Site Contributors <= 1.1.8 Reflected Cross-Site Scripting via alpha PoC, Patch Analysis & Rule
CVE-2026-0594 affects the List Site Contributors plugin for WordPress (up to v1.1.8) with a medium severity CVSS score of 6.1. Ensure to patch to avoid potential XSS attacks from unauthenticated users.
March 18, 2026
CVE-2026-0741: Electric Studio Download Counter <= 2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters PoC, Patch Analysis & Rule
CVE-2026-0741 affects the Electric Studio Download Counter plugin (up to v2.4) with a medium severity (CVSS 4.4) Stored XSS vulnerability. Admins should patch to prevent script injection risks.
March 18, 2026
CVE-2025-15377: Sosh Share Buttons <= 1.1.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2025-15377 affects the Sosh Share Buttons plugin for WordPress (up to v1.1.0) with a medium severity CVSS of 4.3. Unauthenticated attackers can exploit this CSRF vulnerability, so ensure to patch or mitigate it.
March 18, 2026
CVE-2025-15378: AJS Footnotes <= 1.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15378 affects the AJS Footnotes plugin for WordPress, with a CVSS score of 7.2. This high-severity stored XSS vulnerability allows unauthenticated attackers to inject scripts. Ensure you update to the patched version.
March 18, 2026
CVE-2025-14502: News and Blog Designer Bundle <= 1.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-14502 is a critical Local File Inclusion vulnerability in the News And Blog Designer Bundle plugin for WordPress, affecting versions up to 1.1. Unauthenticated attackers can exploit this flaw to execute arbitrary PHP code...
March 18, 2026
CVE-2025-14301: Integration Opvius AI for WooCommerce <= 1.3.0 Unauthenticated Arbitrary File Deletion/Read via Path Traversal PoC, Patch Analysis & Rule
CVE-2025-14301 affects the Woosa Ai For WooCommerce plugin (up to version 1.3.0) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit a path traversal vulnerability, risking sensitive file exposure. Patching is...
March 18, 2026
CVE-2025-14615: DASHBOARD BUILDER <= 1.5.7 Cross-Site Request Forgery to SQL Injection PoC, Patch Analysis & Rule
CVE-2025-14615 affects the Dashboard Builder plugin (up to v1.5.7) with a CVSS score of 7.1. This high-severity SQL injection vulnerability allows unauthenticated attackers to modify SQL queries. Patching is essential to mitigate risks.
March 18, 2026
CVE-2025-15283: Name Directory <= 1.30.3 Unauthenticated Stored Cross-Site Scripting via Multiple Parameters PoC, Patch Analysis & Rule
CVE-2025-15283 affects the Name Directory plugin for WordPress (up to v1.30.3) with a high severity CVSS score of 7.2. Users should upgrade to v1.31.0 to mitigate the risk of stored XSS attacks.
March 18, 2026
CVE-2025-15266: GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15266 affects the Geeky Bot plugin (up to version 1.1.8) with a high severity CVSS score of 7.2 due to stored XSS. Update to version 1.1.9 to mitigate risks from potential script injections.
March 18, 2026
CVE-2025-15020: Gotham Block Extra Light <= 1.5.0 Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode PoC, Patch Analysis & Rule
CVE-2025-15020 affects the Gotham Block Extra Light plugin (v1.5.0) with a medium severity CVSS score of 6.5. Authenticated attackers can exploit a file upload vulnerability to access sensitive server files. Patching is essential.
March 18, 2026
CVE-2025-14880: Netcash WooCommerce Payment Gateway <= 4.1.3 Missing Authorization to Unauthenticated Order Status Modification PoC, Patch Analysis & Rule
CVE-2025-14880 affects the Netcash Pay Now Payment Gateway for WooCommerce (up to v4.1.3) with a CVSS score of 5.3. It allows unauthorized order status modification. Update to v4.1.4 to mitigate this risk.
March 18, 2026
CVE-2025-14613: GetContentFromURL <= 1.0 Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute PoC, Patch Analysis & Rule
CVE-2025-14613 affects the GetContentFromURL plugin (v1.0) with a high severity score of 7.2. Authenticated attackers can exploit this SSRF vulnerability, so patching is crucial to protect internal services.
March 18, 2026
CVE-2025-14389: WPBlogSyn <= 1.0 Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update PoC, Patch Analysis & Rule
CVE-2025-14389 affects the WPBlogSyn plugin (v1.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Unauthenticated attackers can alter sync settings by tricking admins into clicking malicious links. Patching is essential.
March 18, 2026
CVE-2026-0678: Shipping Rates by City for WooCommerce <= 1.0.3 Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter PoC, Patch Analysis & Rule
CVE-2026-0678 affects the Flat Shipping Rate By City for WooCommerce plugin (up to 1.0.3) with a CVSS score of 4.9. Authenticated attackers can exploit a SQL injection vulnerability, so patching is critical for security.
March 18, 2026
CVE-2025-15021: Gotham Block Extra Light <= 1.5.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
CVE-2025-15021 affects the Gotham Block Extra Light plugin (up to version 1.5.0) with a medium severity CVSS score of 4.4. Patching is essential to mitigate the risk of stored XSS attacks in multi-site installations.
March 18, 2026
CVE-2025-14482: Crush.pics Image Optimizer <= 1.8.7 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update PoC, Patch Analysis & Rule
CVE-2025-14482 affects the Crush Pics plugin (up to v1.8.7) with a medium severity (CVSS 4.3) vulnerability. Authenticated users can modify settings, so ensure you patch to the latest version to mitigate risks.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.