AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1236: Envira Gallery for WordPress <= 1.12.3 Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST API PoC, Patch Analysis & Rule
Medium CVE-2026-1236 in Envira Gallery Lite (CVSS 6.4): Envira Gallery for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.12.4.
March 18, 2026
CVE-2026-2363: WP-Members Membership Plugin <= 3.5.5.1 Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-2363 in Wp Members (CVSS 6.5): WP-Members Membership Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.5.6.
March 18, 2026
CVE-2026-1980: WPBookit <= 1.0.8 Missing Authorization to Unauthenticated Sensitive Customer Data Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-1980 in Wpbookit (CVSS 5.3): WPBookit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.9.
March 18, 2026
CVE-2026-1945: WPBookit <= 1.0.8 Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters PoC, Patch Analysis & Rule
High CVE-2026-1945 in Wpbookit (CVSS 7.2): WPBookit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.9.
March 18, 2026
CVE-2026-3523: Apocalypse Meow <= 22.1.0 Authenticated (Administrator+) SQL Injection via 'type' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3523 in Apocalypse Meow (CVSS 4.9): Apocalypse Meow. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 23.0.0.
March 18, 2026
CVE-2026-2289: Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.3 Authenticated (Administrator+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-2289 in Taskbuilder (CVSS 4.4): Taskbuilder – Project Management & Task Management Tool With Kanban Board. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.4.
March 18, 2026
CVE-2026-2292: Morkva UA Shipping <= 1.7.9 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field PoC, Patch Analysis & Rule
Medium CVE-2026-2292 in Morkva Ua Shipping (CVSS 4.4): Morkva UA Shipping. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.10.
March 18, 2026
CVE-2026-22460: FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.4.2 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
Critical CVE-2026-22460 in Formgent (CVSS 9.1): FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
March 18, 2026
CVE-2026-28039: wpDataTables (Premium) <= 6.5.0.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
High CVE-2026-28039 in Wpdatatables (CVSS 8.1): wpDataTables (Premium). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.5.0.2.
March 18, 2026
CVE-2026-1273: PostX <= 5.0.8 Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints PoC, Patch Analysis & Rule
High CVE-2026-1273 in Ultimate Post (CVSS 7.2): PostX. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.9.
March 18, 2026
CVE-2026-1651: Email Subscribers & Newsletters <= 5.9.16 Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1651 in Email Subscribers (CVSS 6.5): Email Subscribers & Newsletters. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.9.17.
March 18, 2026
CVE-2026-2568: WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-2568 in Cf7 Zendesk (CVSS 7.2): WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.6.
March 18, 2026
CVE-2026-24385: Podlove Web Player <= 5.9.1 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-24385 in Podlove Web Player (CVSS 7.5): Podlove Web Player. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.9.2.
March 18, 2026
CVE-2026-22459: WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales <= 1.7.4 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-22459 in Easy Sticky Sidebar (CVSS 5.3): WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.0.
March 18, 2026
CVE-2026-1492: User Registration & Membership <= 5.1.2 Unauthenticated Privilege Escalation via Membership Registration PoC, Patch Analysis & Rule
Critical CVE-2026-1492 in User Registration (CVSS 9.8): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.3.
March 18, 2026
CVE-2026-1487: LatePoint <= 5.2.7 Authenticated (Administrator+) SQL Injection via JSON Import PoC, Patch Analysis & Rule
Medium CVE-2026-1487 in Latepoint (CVSS 6.5): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.2.8.
March 18, 2026
CVE-2026-1336: AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 Missing Authorization to Unauthenticated API Key Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1336 in Ays Chatgpt Assistant (CVSS 5.3): AI ChatBot with ChatGPT and Content Generator by AYS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.7.6.
March 18, 2026
CVE-2026-3180: Contest Gallery <= 28.1.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-3180 in Contest Gallery (CVSS 7.5): Contest Gallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 28.1.5.
March 18, 2026
CVE-2026-2448: Page Builder by SiteOrigin <= 2.33.5 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
High CVE-2026-2448 in Siteorigin Panels (CVSS 8.8): Page Builder by SiteOrigin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.34.0.
March 18, 2026
CVE-2026-28073: Wp EMember <= 10.2.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-28073 in Wp EMember (CVSS 6.1): Wp EMember. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.