AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-2419: WP-DownloadManager <= 1.69 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter PoC, Patch Analysis & Rule
Low CVE-2026-2419 in Wp Downloadmanager (CVSS 2.7): WP-DownloadManager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.69.1.
March 18, 2026
CVE-2026-1655: EventPrime <= 4.2.8.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1655 in Eventprime Event Calendar Management (CVSS 4.3): EventPrime. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.2.8.5.
March 18, 2026
CVE-2026-1656: Business Directory Plugin <= 6.4.20 Missing Authorization to Unauthenticated Arbitrary Listing Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1656 in Business Directory Plugin (CVSS 5.3): Business Directory Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.4.21.
March 18, 2026
CVE-2026-1941: WP Event Aggregator <= 1.8.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1941 in Wp Event Aggregator (CVSS 6.4): WP Event Aggregator. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.9.0.
March 18, 2026
CVE-2026-1860: Kali Forms <= 2.4.8 Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-1860 in Kali Forms (CVSS 4.3): Kali Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.9.
March 18, 2026
CVE-2026-1938: YayMail <= 4.3.2 Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-1938 in Yaymail (CVSS 5.3): YayMail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-1831: YayMail <= 4.3.2 Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation PoC, Patch Analysis & Rule
Low CVE-2026-1831 in Yaymail (CVSS 2.7): YayMail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-1937: YayMail <= 4.3.2 Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action PoC, Patch Analysis & Rule
Critical CVE-2026-1937 in Yaymail (CVSS 9.8): YayMail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-2296: Product Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter PoC, Patch Analysis & Rule
High CVE-2026-2296 in Woo Custom Product Addons (CVSS 7.2): Product Addons for Woocommerce – Product Options with Custom Fields. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
March 18, 2026
CVE-2026-1807: InteractiveCalculator for WordPress <= 1.0.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1807 in Interactivecalculator (CVSS 6.4): InteractiveCalculator for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2281: Private Comment <= 0.0.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting PoC, Patch Analysis & Rule
Medium CVE-2026-2281 in Private Comment (CVSS 4.4): Private Comment. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.0.5.
March 18, 2026
CVE-2026-1943: YayMail <= 4.3.2 Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements PoC, Patch Analysis & Rule
Medium CVE-2026-1943 in Yaymail (CVSS 4.4): YayMail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-2019: Cart All In One For WooCommerce <= 1.1.21 Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting PoC, Patch Analysis & Rule
High CVE-2026-2019 in Woo Cart All In One (CVSS 7.2): Cart All In One For WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2633: Gutenberg Blocks with AI by Kadence WP <= 3.6.1 Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload PoC, Patch Analysis & Rule
Medium CVE-2026-2633 in Kadence Blocks (CVSS 4.3): Gutenberg Blocks with AI by Kadence WP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.2.
March 18, 2026
CVE-2026-1857: Gutenberg Blocks with AI by Kadence WP <= 3.6.1 Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1857 in Kadence Blocks (CVSS 4.3): Gutenberg Blocks with AI by Kadence WP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.2.
March 18, 2026
CVE-2026-1666: Download Manager <= 3.3.46 Reflected Cross-Site Scripting via 'redirect_to' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1666 in Download Manager (CVSS 6.1): Download Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.47.
March 18, 2026
CVE-2026-1640: Taskbuilder <= 5.0.2 Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation PoC, Patch Analysis & Rule
Medium CVE-2026-1640 in Taskbuilder (CVSS 4.3): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.3.
March 18, 2026
CVE-2026-1072: Keybase.io Verification <= 1.4.5 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1072 in Wp Keybase Verification (CVSS 4.3): Keybase.io Verification. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.6.
March 18, 2026
CVE-2026-1906: PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1906 in Woocommerce Pdf Invoices Packing Slips (CVSS 4.3): PDF Invoices & Packing Slips for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.7.0.
March 18, 2026
CVE-2026-2023: WP Plugin Info Card <= 6.2.0 Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation PoC, Patch Analysis & Rule
Medium CVE-2026-2023 in Wp Plugin Info Card (CVSS 4.3): WP Plugin Info Card. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.3.0.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.