AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-12067: Table Field Add-on for ACF and SCF <= 1.3.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content PoC, Patch Analysis & Rule
Medium CVE-2025-12067 in Advanced Custom Fields Table Field (CVSS 6.4): Table Field Add-on for ACF and SCF. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.31.
March 18, 2026
CVE-2025-13766: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-13766 in Masterstudy Lms Learning Management System (CVSS 5.4): MasterStudy LMS WordPress Plugin – for Online Courses and Education. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-13812: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.1 Missing Authorization to Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-13812 in Gamipress (CVSS 4.3): GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
March 18, 2026
CVE-2025-15001: FS Registration Password <= 1.0.1 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2025-15001 in Registration Password (CVSS 9.8): FS Registration Password. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.1.
March 18, 2026
CVE-2025-13964: LearnPress – WordPress LMS Plugin <= 4.3.2 Missing Authentication to Unauthenticated Course Modification PoC, Patch Analysis & Rule
Medium CVE-2025-13964 in Learnpress (CVSS 5.3): LearnPress – WordPress LMS Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.2.1.
March 18, 2026
CVE-2025-14438: Xagio SEO <= 7.1.0.30 Authenticated (Subscriber+) Server-Side Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2025-14438 in Xagio Seo (CVSS 6.4): Xagio SEO. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.1.0.31.
March 18, 2026
CVE-2025-14997: BuddyPress Xprofile Custom Field Types <= 1.2.8 Authenticated (Subscriber+) Arbitrary File Deletion PoC, Patch Analysis & Rule
High CVE-2025-14997 in Bp Xprofile Custom Field Types (CVSS 7.2): BuddyPress Xprofile Custom Field Types. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.0.
March 18, 2026
CVE-2025-14996: AS Password Field In Default Registration Form <= 2.0.0 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2025-14996 in As Password Field In Default Registration Form (CVSS 9.8): AS Password Field In Default Registration Form. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14120: URL Image Importer <= 1.0.7 Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload PoC, Patch Analysis & Rule
Medium CVE-2025-14120 in Url Image Importer (CVSS 6.4): URL Image Importer. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.8.
March 18, 2026
CVE-2025-13652: CBX Bookmark & Favorite <= 2.0.4 Authenticated (Subscriber+) SQL Injection via `orderby` Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13652 in Cbxwpbookmark (CVSS 6.5): CBX Bookmark & Favorite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.5.
March 18, 2026
CVE-2026-0604: FastDup <= 2.7 Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0604 in Fastdup (CVSS 6.5): FastDup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14034: ilGhera Support System for WooCommerce <= 1.2.6 Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-14034 in Wc Support System (CVSS 5.3): ilGhera Support System for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.7.
March 18, 2026
CVE-2025-11723: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-11723 in Simply Schedule Appointments (CVSS 6.5): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14441: Popupkit <= 2.2.0 Missing Authorization to Authenticated (Subscriber+) Arbitrary Subscriber Data Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-14441 in Popup Builder Block (CVSS 5.3): Popupkit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.2.1.
March 18, 2026
CVE-2025-11370: Depicter <= 4.0.7 Missing Authorization to Unauthenticated Display Rule Updates PoC, Patch Analysis & Rule
Medium CVE-2025-11370 in Depicter (CVSS 5.3): Depicter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.7.0.
March 18, 2026
CVE-2025-14153: Page Expire Popup/Redirection for WordPress <= 1.0 Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2025-14153 in Page Expire Popup (CVSS 6.5): Page Expire Popup/Redirection for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13746: ForumWP – Forum & Discussion Board <= 2.1.6 Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name PoC, Patch Analysis & Rule
Medium CVE-2025-13746 in Forumwp (CVSS 6.4): ForumWP – Forum & Discussion Board. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.7.
March 18, 2026
CVE-2025-13409: Form Vibes – Database Manager for Forms <= 1.4.13 Authenticated (Admin+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2025-13409 in Form Vibes (CVSS 4.9): Form Vibes – Database Manager for Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.
March 18, 2026
CVE-2025-68523: Spiffy Calendar <= 5.0.7 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-68523 in Spiffy Calendar (CVSS 4.3): Spiffy Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.8.
March 18, 2026
CVE-2025-15364: Download Manager <= 3.3.40 Unauthenticated Limited Privilege Escalation via updatePassword PoC, Patch Analysis & Rule
High CVE-2025-15364 in Download Manager (CVSS 7.3): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.41.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.