AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-27050: RealPress – Real Estate Plugin <= 1.1.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
CVE-2026-27050 affects the RealPress plugin for WordPress (up to v1.1.0) with a medium severity (CVSS 4.3) CSRF vulnerability. Update to v1.1.1 to mitigate unauthorized actions by attackers.
March 18, 2026
CVE-2025-68906: JNews Video <= 11.0.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68906 affects the JNews Video plugin (up to version 11.0.2) with a medium severity CVSS score of 6.1 due to reflected XSS. Users should update to the patched version to mitigate risks from potential attacks.
March 18, 2026
CVE-2026-24614: Flex QR Code Generator <= 1.2.10 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24614 affects the Flex QR Code Generator plugin (up to 1.2.10) with a medium severity CVSS score of 6.4. Patching is essential to mitigate the risk of stored cross-site scripting attacks by authenticated users.
March 18, 2026
CVE-2026-24613: Ecwid Shopping Cart <= 7.0.6 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24613 affects the Ecwid Shopping Cart plugin for WordPress (up to 7.0.6) with a CVSS score of 5.3. Unauthenticated attackers can exploit this remote code execution vulnerability. Update to version 7.0.7 to mitigate risks.
March 18, 2026
CVE-2025-14507: EventPrime Events Calendar, Bookings and Tickets <= 4.2.7.0 Unauthenticated Sensitive Information Exposure via REST API PoC, Patch Analysis & Rule
CVE-2025-14507 affects the Eventprime Event Calendar Management plugin (versions up to 4.2.7.0) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive booking data via the REST API. Upgrade to version 4.2.8.0 to mitigate.
March 18, 2026
CVE-2025-68905: JNews Pay Writer <= 11.0.0 Authenticated (Subscriber+) Local File Inclusion PoC, Patch Analysis & Rule
CVE-2025-68905 affects the JNews Pay Writer plugin (up to v11.0.0) with a CVSS score of 7.5. Authenticated attackers can exploit this high-severity authentication bypass to execute arbitrary files. Update to the patched version to...
March 18, 2026
CVE-2025-49049: DZS Video Gallery <= 12.39 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-49049 affects the Dzs Videogallery plugin (up to version 12.39) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated attackers can exploit this flaw to extract sensitive database information.
March 18, 2026
CVE-2025-15030: User Profile Builder <= 3.15.1 Unauthenticated Privilege Escalation via Account Takeover PoC, Patch Analysis & Rule
CVE-2025-15030 affects the Profile Builder plugin (up to 3.15.1) with a critical CVSS score of 9.8. Unauthenticated attackers can exploit this to reset user passwords. Update to version 3.15.2 to mitigate the risk.
March 18, 2026
CVE-2026-0684: CP Image Store with Slideshow <= 1.1.9 Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import PoC, Patch Analysis & Rule
CVE-2026-0684 affects the CP Image Store plugin (up to v1.1.9) with a medium severity (CVSS 4.3) vulnerability allowing authenticated users to bypass authorization and import products via XML. Update to v1.2.0 to mitigate this risk.
March 18, 2026
CVE-2025-14001: WP Duplicate Page <= 1.8 Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication PoC, Patch Analysis & Rule
CVE-2025-14001 affects the WP Duplicate Page plugin (up to version 1.8) with a CVSS score of 5.4. Authenticated users can exploit this medium severity vulnerability to duplicate posts and WooCommerce orders. Update to version 1.8.1 to...
March 18, 2026
CVE-2025-49050: Lead Capturing Pages <= 2.5 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2025-49050 affects the Wp Lead Capture plugin (version 2.5) with a medium severity (CVSS 6.5) SQL injection vulnerability. Authenticated attackers can exploit this flaw to extract sensitive database information. Patching is advised.
March 18, 2026
CVE-2025-50004: JupiterX Core <= 4.10.1 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
CVE-2025-50004 affects the JupiterX Core plugin (up to 4.10.1) with a high severity CVSS score of 7.5. Users should upgrade to version 4.11.0 to mitigate the risk of PHP Object Injection vulnerabilities.
March 18, 2026
CVE-2025-69362: UiChemy <= 4.4.2 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-69362 affects the UiChemy plugin (up to v4.4.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users should upgrade to v4.4.3 to mitigate risks from potential script injections.
March 18, 2026
CVE-2025-69363: Responsive Addons for Elementor <= 2.0.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2025-69363 affects the Responsive Addons for Elementor plugin (up to v2.0.8) with a medium severity (CVSS 4.3). Authenticated users can perform unauthorized actions. Update to v2.0.9 to mitigate this vulnerability.
March 18, 2026
CVE-2025-49066: Accordion Slider PRO <= 1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-49066 affects the Accordion Slider PRO plugin for WordPress, with a medium severity CVSS score of 6.1. Users should update from version 1.2 to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2025-49046: xPromoter <= 1.3.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-49046 affects the Top_bar_promoter plugin for WordPress (up to version 1.3.4) with a medium severity CVSS score of 6.1. Users should update to the patched version to mitigate the reflected XSS vulnerability.
March 18, 2026
CVE-2025-68904: JNews Frontend Submit <= 11.0.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2025-68904 affects the JNews Frontend Submit plugin (up to version 11.0.0) with a medium severity CVSS score of 6.1 due to reflected XSS. Ensure you update to the patched version to mitigate potential exploitation.
March 18, 2026
CVE-2026-24616: WP Popups <= 2.2.0.5 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24616 affects WP Popups Lite versions up to 2.2.0.5, allowing unauthorized actions for authenticated users. Update to version 2.2.0.6 to mitigate this medium-severity vulnerability with a CVSS score of 4.3.
March 18, 2026
CVE-2026-24619: PopCash.Net Code Integration Tool <= 1.8 Missing Authorization PoC, Patch Analysis & Rule
CVE-2026-24619 affects the Popcash.Net Code Integration Tool plugin (up to v1.8) with a CVSS score of 5.3. Unauthenticated attackers can change settings; update to v2.0 to mitigate this risk.
March 18, 2026
CVE-2026-24617: Easy Modal <= 2.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-24617 affects the Easy Modal plugin for WordPress (up to version 2.1.0) with a medium severity CVSS score of 6.4. Authenticated users can exploit this stored XSS vulnerability, so patching is essential.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.