AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1639: Taskbuilder <= 5.0.2 Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-1639 in Taskbuilder (CVSS 6.5): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.3.
March 18, 2026
CVE-2025-11737: VK All in One Expansion Unit <= 9.112.3 Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title PoC, Patch Analysis & Rule
Medium CVE-2025-11737 in Vk All In One Expansion Unit (CVSS 6.4): VK All in One Expansion Unit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-12071: Frontend User Notes <= 2.1.0 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification PoC, Patch Analysis & Rule
Medium CVE-2025-12071 in Frontend User Notes (CVSS 4.3): Frontend User Notes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.1.
March 18, 2026
CVE-2025-12356: Tickera – WordPress Event Ticketing <= 3.5.6.4 Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update PoC, Patch Analysis & Rule
Medium CVE-2025-12356 in Tickera Event Ticketing System (CVSS 4.3): Tickera – WordPress Event Ticketing. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.5.6.5.
March 18, 2026
CVE-2025-12122: Popup Box – Easily Create WordPress Popups <= 3.2.12 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-12122 in Popup Box (CVSS 6.4): Popup Box – Easily Create WordPress Popups. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.2.13.
March 18, 2026
CVE-2026-1304: Membership Plugin – Restrict Content <= 3.2.18 Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings PoC, Patch Analysis & Rule
Medium CVE-2026-1304 in Restrict Content (CVSS 4.4): Membership Plugin – Restrict Content. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.2.19.
March 18, 2026
CVE-2025-12075: Order Splitter for WooCommerce <= 5.3.5 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-12075 in Woo Order Splitter (CVSS 4.3): Order Splitter for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.6.
March 18, 2026
CVE-2026-1925: EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1925 in Emailkit (CVSS 4.3): EmailKit – Email Customizer for WooCommerce & WP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.3.
March 18, 2026
CVE-2025-12037: WP 404 Auto Redirect <= 1.0.5 Authenticated (Admin+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-12037 in Wp 404 Auto Redirect To Similar Post (CVSS 4.4): WP 404 Auto Redirect. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.6.
March 18, 2026
CVE-2026-1296: Frontend Post Submission Manager Lite <= 1.2.7 Unauthenticated Open Redirect via 'requested_page' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1296 in Frontend Post Submission Manager Lite (CVSS 6.1): Frontend Post Submission Manager Lite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.8.
March 18, 2026
CVE-2025-13959: Filestack <= 2.0.8 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2025-13959 in Filepicker Media Uploader (CVSS 6.4): Filestack. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1714: ShopLentor <= 3.3.2 Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action PoC, Patch Analysis & Rule
High CVE-2026-1714 in Woolentor Addons (CVSS 8.6): ShopLentor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.3.
March 18, 2026
CVE-2025-6460: Display During Conditional Shortcode <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-6460 in Display During Conditional Shortcode (CVSS 6.4): Display During Conditional Shortcode. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.
March 18, 2026
CVE-2026-1277: URL Shortify <= 1.12.1 Unauthenticated Open Redirect via 'redirect_to' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1277 in Url Shortify (CVSS 4.7): URL Shortify. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.12.2.
March 18, 2026
CVE-2026-2576: Business Directory Plugin <= 6.4.21 Unauthenticated SQL Injection via payment Parameter PoC, Patch Analysis & Rule
High CVE-2026-2576 in Business Directory Plugin (CVSS 7.5): Business Directory Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.4.22.
March 18, 2026
CVE-2026-3075: Simple Ajax Chat <= 20251121 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-3075 in Simple Ajax Chat (CVSS 5.3): Simple Ajax Chat. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 20260217.
March 18, 2026
CVE-2026-1931: Rent Fetch <= 0.32.4 Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter PoC, Patch Analysis & Rule
High CVE-2026-1931 in Rentfetch (CVSS 7.2): Rent Fetch. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.32.7.
March 18, 2026
CVE-2026-2230: Booking Calendar <= 10.14.14 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification PoC, Patch Analysis & Rule
Medium CVE-2026-2230 in Booking (CVSS 4.3): Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 10.14.15.
March 18, 2026
CVE-2025-14799: Brevo Email, SMS, Web Push, Chat, and more. <= 3.3.0 Unauthenticated Authorization Bypass via Type Juggling PoC, Patch Analysis & Rule
Medium CVE-2025-14799 in Mailin (CVSS 6.5): Brevo - Email, SMS, Web Push, Chat, and more.. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.3.1.
March 18, 2026
CVE-2026-25370: Compress <= 6.60.28 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25370 in Wp Compress Image Optimizer (CVSS 5.3): Compress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.60.29.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.