AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-12172: Mailchimp List Subscribe Form <= 2.0.0 Cross-Site Request Forgery to Mailchimp List Change PoC, Patch Analysis & Rule
Medium CVE-2025-12172 in Mailchimp (CVSS 4.3): Mailchimp List Subscribe Form. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.1.
March 18, 2026
CVE-2025-11706: Aruba HiSpeed Cache <= 3.0.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-11706 in Aruba Hispeed Cache (CVSS 6.1): Aruba HiSpeed Cache. Atomic Edge summarizes impact, exploitability, and patch details.
March 18, 2026
CVE-2025-11754: Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.1.2 Missing Authorization to Sensitive Information Exposure PoC, Patch Analysis & Rule
High CVE-2025-11754 in Gdpr Cookie Consent (CVSS 7.5): Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA &.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-12081: ACF Photo Gallery Field <= 3.0 Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification PoC, Patch Analysis & Rule
Medium CVE-2025-12081 in Navz Photo Gallery (CVSS 4.3): ACF Photo Gallery Field. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.
March 18, 2026
CVE-2026-2386: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type' PoC, Patch Analysis & Rule
Medium CVE-2026-2386 in The Plus Addons For Elementor Page Builder (CVSS 4.3): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce. Atomic Edge summarizes impact, exploitability, and...
March 18, 2026
CVE-2025-13732: s2Member <= 251005 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-13732 in S2member (CVSS 6.4): s2Member. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 260101.
March 18, 2026
CVE-2026-1581: wpForo Forum <= 2.4.14 Unauthenticated Time-Based SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-1581 in Wpforo (CVSS 7.5): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.15.
March 18, 2026
CVE-2026-23541: Mail Mint <= 1.19.4 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-23541 in Mail Mint (CVSS 5.3): Mail Mint. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.19.5.
March 18, 2026
CVE-2026-23549: WpEvently <= 5.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-23549 in Mage Eventpress (CVSS 8.1): WpEvently. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14864: Virusdie <= 1.1.7 Missing Authorization to Authenticated (Subscriber+) API Key Disclosure PoC, Patch Analysis & Rule
Medium CVE-2025-14864 in Virusdie (CVSS 4.3): Virusdie. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.8.
March 18, 2026
CVE-2025-14294: Razorpay for WooCommerce <= 4.7.8 Missing Authentication to Unauthenticated Order Modification PoC, Patch Analysis & Rule
Medium CVE-2025-14294 in Woo Razorpay (CVSS 5.3): Razorpay for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.7.9.
March 18, 2026
CVE-2026-25375: Image Photo Gallery Final Tiles Grid <= 3.6.10 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25375 in Final Tiles Grid Gallery Lite (CVSS 4.3): Image Photo Gallery Final Tiles Grid. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.11.
March 18, 2026
CVE-2025-12707: Library Management System <= 3.2.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-12707 in Library Management System (CVSS 7.5): Library Management System. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.
March 18, 2026
CVE-2025-13079: Popup Builder Create highly converting, mobile friendly marketing popups. <= 4.4.2 Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens PoC, Patch Analysis & Rule
Medium CVE-2025-13079 in Popup Builder (CVSS 5.3): Popup Builder - Create highly converting, mobile friendly marketing popups.. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.4.3.
March 18, 2026
CVE-2026-1461: Simple Membership <= 4.7.0 Unauthenticated Improper Handling of Missing Values PoC, Patch Analysis & Rule
Medium CVE-2026-1461 in Simple Membership (CVSS 6.5): Simple Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.7.1.
March 18, 2026
CVE-2026-1219: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 5.10 Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-1219 in Mp3 Music Player By Sonaar (CVSS 5.3): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated.... Atomic Edge summarizes impact, exploitability, and patch details, with...
March 18, 2026
CVE-2025-15041: BackWPup 5.0.0 5.6.2 Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update PoC, Patch Analysis & Rule
High CVE-2025-15041 in Backwpup (CVSS 7.2): BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2025-12027: Mesmerize Companion <= 1.6.158 Missing Authorization Authenticated (Subscriber+) Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-12027 in Mesmerize Companion (CVSS 4.3): Mesmerize Companion. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2232: Product Table and List Builder for WooCommerce Lite <= 4.6.2 Unauthenticated Time-Based SQL Injection via 'search' Parameter PoC, Patch Analysis & Rule
High CVE-2026-2232 in Wc Product Table Lite (CVSS 7.5): Product Table and List Builder for WooCommerce Lite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.6.3.
March 18, 2026
CVE-2025-12845: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 1.2.1 Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation PoC, Patch Analysis & Rule
High CVE-2025-12845 in Tablesome (CVSS 8.8): Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 -.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.