AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-12178: SpiceForms Form Builder <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
CVE-2025-12178 affects the Spiceforms Form Builder plugin (v1.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can inject scripts, impacting site security. Update to the patched version to mitigate risks.
March 18, 2026
CVE-2026-0680: Real Post Slider Lite <= 2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PoC, Patch Analysis & Rule
CVE-2026-0680 affects the Real Post Slider Lite plugin (up to version 2.4) with a medium severity CVSS score of 4.4. Admin-level users can exploit this stored XSS vulnerability, so ensure timely patching or WAF coverage.
March 18, 2026
CVE-2025-13627: Makesweat <= 0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting PoC, Patch Analysis & Rule
CVE-2025-13627 affects the Makesweat plugin for WordPress (version 0.1) with a medium severity (CVSS 4.4). Authenticated attackers can exploit stored XSS. Ensure you patch to mitigate this risk.
March 18, 2026
CVE-2025-14464: PDF Resume Parser <= 1.0 Unauthenticated Sensitive Information Disclosure in SMTP Credentials PoC, Patch Analysis & Rule
CVE-2025-14464 affects the PDF Resume Parser plugin (v1.0) with a CVSS score of 5.3. Unauthenticated users can access sensitive SMTP credentials. Update to the latest version to mitigate this risk.
March 18, 2026
CVE-2026-0717: LottieFiles – Lottie block for Gutenberg <= 3.0.0 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
CVE-2026-0717 affects the Lottiefiles plugin (up to v3.0.0) with a CVSS score of 5.3, exposing sensitive information via the REST API. Users should patch to mitigate risks of credential exposure.
March 18, 2026
CVE-2025-14725: Internal Link Builder <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings PoC, Patch Analysis & Rule
CVE-2025-14725 affects the Internal Link Builder plugin for WordPress (v1.0) with a CVSS score of 4.4. It allows authenticated admins to inject scripts, impacting multi-site setups. Patching is essential to mitigate this XSS risk.
March 18, 2026
CVE-2026-0635: Responsive Accordion Slider <= 1.2.2 Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images' PoC, Patch Analysis & Rule
CVE-2026-0635 affects the Responsive Accordion Slider plugin (up to v1.2.2) with a medium severity (CVSS 4.3). Authenticated users can modify slider image metadata. Update to the patched version to mitigate this risk.
March 18, 2026
CVE-2026-0694: SearchWiz <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title PoC, Patch Analysis & Rule
CVE-2026-0694 affects the SearchWiz plugin for WordPress (up to v1.0.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should update to the patched version to mitigate risks from authenticated attackers.
March 18, 2026
CVE-2025-69098: Hide My WP <= 6.2.12 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69098 affects the Hide My WP plugin (up to version 6.2.12) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS risk.
March 18, 2026
CVE-2025-14379: Testimonials Creator 1.6 Authenticated (Admin+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-14379 affects the Testimonials Creator plugin for WordPress (v1.6) with a CVSS score of 4.4. This medium severity XSS vulnerability allows admin-level attackers to inject scripts. Ensure you update to the patched version.
March 18, 2026
CVE-2025-69001: FluentForm <= 6.1.11 Unauthenticated Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
CVE-2025-69001 affects the Fluent Forms plugin (up to version 6.1.11) with a medium severity CVSS score of 6.5. Unauthenticated attackers can exploit it for arbitrary shortcode execution. Update to version 6.1.12 to mitigate risks.
March 18, 2026
CVE-2025-15486: Kunze Law <= 2.1 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-15486 affects the Kunze Law WordPress plugin (up to v2.1) with a CVSS score of 4.4. Authenticated attackers can exploit stored XSS and path traversal vulnerabilities. Patching is essential for security.
March 18, 2026
CVE-2025-69097: WPLMS <= 1.9.9.5.4 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-69097 reveals a critical file upload vulnerability in the WPLMS Plugin for WordPress, affecting versions up to 1.9.9.5.4. Unauthenticated attackers can delete server files, risking remote code execution. Update to the patched...
March 18, 2026
CVE-2025-14854: WP-CRM System – Manage Clients and Projects <= 3.4.5 Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification PoC, Patch Analysis & Rule
CVE-2025-14854 affects WP-CRM System plugin versions up to 3.4.5, with a CVSS score of 5.4. Authenticated attackers can access PII and modify tasks. Upgrade to version 3.4.6 to mitigate these risks.
March 18, 2026
CVE-2025-69364: Breeze <= 2.2.21 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69364 affects the Breeze plugin for WordPress (up to v2.2.21) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized cache purges. Update to v2.2.22 to mitigate this risk.
March 18, 2026
CVE-2025-69095: Reservation <= 1.7 Missing Authorization to Unauthenticated Settings Update PoC, Patch Analysis & Rule
CVE-2025-69095 affects the Dt Reservation Plugin for WordPress (up to version 1.7) with a medium severity score of 5.3. Unauthenticated attackers can modify settings, so ensure you update to the patched version.
March 18, 2026
CVE-2026-22332: Tutor LMS Pro <= 3.8.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-22332 affects Tutor Pro plugin versions up to 3.8.3, allowing unauthenticated SQL injection with a CVSS score of 7.5. Users should patch to the latest version to mitigate potential database compromise.
March 18, 2026
CVE-2026-24360: Seriously Simple Podcasting <= 3.14.1 Authenticated (Editor+) Server-Side Request Forgery PoC, Patch Analysis & Rule
CVE-2026-24360 affects the Seriously Simple Podcasting plugin for WordPress (up to version 3.14.1) with a medium severity CVSS score of 5.5. Update to version 3.14.2 to mitigate the server-side request forgery risk.
March 18, 2026
CVE-2026-24608: Laurent Core <= 2.4.1 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2026-24608 affects the Laurent Core plugin for WordPress (up to version 2.4.1) with a CVSS score of 7.5. Authenticated attackers can exploit this high-severity vulnerability to bypass access controls and execute arbitrary PHP code.
March 18, 2026
CVE-2025-68912: HDForms <= 1.6.1 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
CVE-2025-68912 affects the HDForms plugin for WordPress (up to 1.6.1) with a critical CVSS score of 9.1. Unauthenticated attackers can delete arbitrary files, risking remote code execution. Update to the patched version immediately.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.