AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2025-13612: Album and Image Gallery Plus Lightbox <= 2.1.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-13612 in Album And Image Gallery Plus Lightbox (CVSS 6.4): Album and Image Gallery Plus Lightbox. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.8.
March 18, 2026
CVE-2026-23545: Aruba HiSpeed Cache <= 3.0.4 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-23545 in Aruba Hispeed Cache (CVSS 5.3): Aruba HiSpeed Cache. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.5.
March 18, 2026
CVE-2025-12448: Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-12448 in Smartsupp Live Chat (CVSS 6.4): Smartsupp – live chat, AI shopping assistant and chatbots. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.2.
March 18, 2026
CVE-2025-13738: Easy Table of Contents <= 2.0.78 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13738 in Easy Table Of Contents (CVSS 6.4): Easy Table of Contents. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.79.
March 18, 2026
CVE-2025-13113: Web Accessibility by accessiBe <= 2.11 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-13113 in Accessibe (CVSS 5.3): Web Accessibility by accessiBe. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.12.
March 18, 2026
CVE-2025-13842: Breadcrumb NavXT <= 7.5.0 Missing Authorization to Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-13842 in Breadcrumb Navxt (CVSS 5.3): Breadcrumb NavXT. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.5.1.
March 18, 2026
CVE-2025-14445: Image Hotspot by DevVN <= 1.2.9 Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta PoC, Patch Analysis & Rule
Medium CVE-2025-14445 in Devvn Image Hotspot (CVSS 6.4): Image Hotspot by DevVN. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.0.
March 18, 2026
CVE-2026-2426: WP-DownloadManager <= 1.69 Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2426 in Wp Downloadmanager (CVSS 6.5): WP-DownloadManager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.69.1.
March 18, 2026
CVE-2026-0549: Groups <= 3.10.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0549 in Groups (CVSS 6.4): Groups. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.11.0.
March 18, 2026
CVE-2025-14444: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment PoC, Patch Analysis & Rule
Medium CVE-2025-14444 in Custom Registration Form Builder With Submission Manager (CVSS 5.3): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. Atomic Edge summarizes impact, exploitability...
March 18, 2026
CVE-2025-14983: Advanced Custom Fields: Font Awesome <= 5.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-14983 in Advanced Custom Fields Font Awesome (CVSS 6.4): Advanced Custom Fields: Font Awesome. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.2.
March 18, 2026
CVE-2025-13048: Official StatCounter Plugin <= 2.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname PoC, Patch Analysis & Rule
Medium CVE-2025-13048 in Official Statcounter Plugin For Wordpress (CVSS 6.4): Official StatCounter Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.1.
March 18, 2026
CVE-2026-1942: Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1942 in Blog2social (CVSS 6.5): Blog2Social: Social Media Auto Post & Scheduler. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.7.5.
March 18, 2026
CVE-2025-11185: Complianz | GDPR/CCPA Cookie Consent <= 7.4.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-11185 in Complianz Gdpr (CVSS 6.4): Complianz | GDPR/CCPA Cookie Consent. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.4.4.
March 18, 2026
CVE-2026-2126: User Submitted Posts <= 20260113 Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2126 in User Submitted Posts (CVSS 5.3): User Submitted Posts. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 20260217.
March 18, 2026
CVE-2026-2495: WPNakama <= 0.6.5 Unauthenticated SQL Injection via 'order' REST API Parameter PoC, Patch Analysis & Rule
High CVE-2026-2495 in Wpnakama (CVSS 7.5): WPNakama. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13727: Video Share VOD <= 2.7.11 Authenticated (Editor+) Stored Cross-Site Scripting via Custom Field Meta Values PoC, Patch Analysis & Rule
Medium CVE-2025-13727 in Video Share Vod (CVSS 4.4): Video Share VOD. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2127: SiteOrigin Widgets Bundle <= 1.70.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution PoC, Patch Analysis & Rule
Medium CVE-2026-2127 in So Widgets Bundle (CVSS 5.4): SiteOrigin Widgets Bundle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.71.0.
March 18, 2026
CVE-2026-1649: Community Events <= 1.5.7 Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1649 in Community Events (CVSS 4.4): Community Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.8.
March 18, 2026
CVE-2026-2112: Dam Spam <= 1.0.8 Cross-Site Request Forgery to Arbitrary Pending Comment Deletion PoC, Patch Analysis & Rule
Medium CVE-2026-2112 in Dam Spam (CVSS 4.3): Dam Spam. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.