AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-24539: Protección de datos – RGPD <= 0.68 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24539 in Proteccion Datos Rgpd (CVSS 5.3): Protección de datos – RGPD. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.69.
March 18, 2026
CVE-2026-0911: Hustle <= 7.8.9.2 Authenticated (Subscriber+) Arbitrary File Upoload via Module Import PoC, Patch Analysis & Rule
High CVE-2026-0911 in Wordpress Popup (CVSS 7.5): Hustle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.8.9.3.
March 18, 2026
CVE-2025-13205: SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 Cross-Site Request Forgery to Survey Cloning PoC, Patch Analysis & Rule
Medium CVE-2025-13205 in Surveyjs (CVSS 4.3): SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-13920: WP Directory Kit <= 1.4.9 Unauthenticated Email Exposure via wdk_public_action PoC, Patch Analysis & Rule
Medium CVE-2025-13920 in Wpdirectorykit (CVSS 5.3): WP Directory Kit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.0.
March 18, 2026
CVE-2026-1300: Responsive Header Plugin <= 1.0 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-1300 in Responsive Header (CVSS 4.4): Responsive Header Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13139: SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 Cross-Site Request Forgery to Survey Creation PoC, Patch Analysis & Rule
Medium CVE-2025-13139 in Surveyjs (CVSS 4.3): SurveyJS: Drag & Drop WordPress Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13194: SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 Cross-Site Request Forgery to Survey Renaming PoC, Patch Analysis & Rule
Medium CVE-2025-13194 in Surveyjs (CVSS 4.3): SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2026-1208: Friendly Functions for Welcart <= 1.2.5 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1208 in Friendly Functions For Welcart (CVSS 4.3): Friendly Functions for Welcart. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.6.
March 18, 2026
CVE-2026-1127: Timeline Event History <= 3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1127 in Timeline Event History (CVSS 6.1): Timeline Event History. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1189: LeadBI Plugin for WordPress <= 1.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1189 in Leadbi (CVSS 6.4): LeadBI Plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1266: Postalicious <= 3.0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
Medium CVE-2026-1266 in Postalicious (CVSS 4.4): Postalicious. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0800: User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 Unauthenticated Stored Cross-Site Scripting via Custom Field PoC, Patch Analysis & Rule
High CVE-2026-0800 in User Submitted Posts (CVSS 7.2): User Submitted Posts – Enable Users to Submit Posts from the Front End. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 20260110.
March 18, 2026
CVE-2025-14907: Moderate Selected Posts <= 1.4 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14907 in Moderate Selected Posts (CVSS 4.3): Moderate Selected Posts. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1191: JavaScript Notifier <= 1.2.8 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
Medium CVE-2026-1191 in Javascript Notifier (CVSS 4.4): JavaScript Notifier. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0687: Meta-box GalleryMeta <= 3.0.1 Missing Authorization to Authenticated (Author+) Gallery Management PoC, Patch Analysis & Rule
Medium CVE-2026-0687 in Meta Box Gallerymeta (CVSS 4.3): Meta-box GalleryMeta. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.1.
March 18, 2026
CVE-2026-0633: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 Unauthenticated Form Submission Exposure via Forgeable Cookie Value PoC, Patch Analysis & Rule
Low CVE-2026-0633 in Metform (CVSS 3.7): MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.1.1.
March 18, 2026
CVE-2026-1302: Meta-box GalleryMeta <= 3.0.1 Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption PoC, Patch Analysis & Rule
Medium CVE-2026-1302 in Meta Box Gallerymeta (CVSS 4.4): Meta-box GalleryMeta. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.
March 18, 2026
CVE-2025-15516: All-in-One Video Gallery 4.1.0 4.6.4 Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update PoC, Patch Analysis & Rule
Medium CVE-2025-15516 in All In One Video Gallery (CVSS 4.3): All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited.... Atomic Edge summarizes impact, exploitability, and patch details...
March 18, 2026
CVE-2026-1098: CM CSS Columns <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1098 in Cm Css Columns (CVSS 6.4): CM CSS Columns. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14630: AdminQuickbar <= 1.9.3 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14630 in Adminquickbar (CVSS 4.3): AdminQuickbar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.