AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-22356: Jetpack CRM <= 6.7.0 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
High CVE-2026-22356 in Zero Bs Crm (CVSS 8.1): Jetpack CRM. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.7.1.
March 18, 2026
CVE-2026-25362: FooGallery <= 3.1.11 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-25362 in Foogallery (CVSS 6.4): FooGallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.13.
March 18, 2026
CVE-2026-1750: Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access PoC, Patch Analysis & Rule
High CVE-2026-1750 in Ecwid Shopping Cart (CVSS 8.8): Ecwid by Lightspeed Ecommerce Shopping Cart. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.0.8.
March 18, 2026
CVE-2026-25364: Client Invoicing by Sprout Invoices <= 20.8.8 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25364 in Sprout Invoices (CVSS 5.3): Client Invoicing by Sprout Invoices. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 20.8.9.
March 18, 2026
CVE-2026-25348: Download Alt Text AI <= 1.10.15 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25348 in Alttext Ai (CVSS 5.3): Download Alt Text AI. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.10.18.
March 18, 2026
CVE-2026-1490: Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation PoC, Patch Analysis & Rule
Critical CVE-2026-1490 in Cleantalk Spam Protect (CVSS 9.8): Spam protection, Honeypot, Anti-Spam by CleanTalk. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.72.
March 18, 2026
CVE-2026-1512: Essential Addons for Elementor <= 6.5.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget PoC, Patch Analysis & Rule
Medium CVE-2026-1512 in Essential Addons For Elementor Lite (CVSS 6.4): Essential Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.5.10.
March 18, 2026
CVE-2026-25331: Activity Log <= 5.5.4 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-25331 in Wp Security Audit Log (CVSS 6.4): Activity Log. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.6.0.
March 18, 2026
CVE-2026-2312: Media Library Folders <= 8.3.6 Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename PoC, Patch Analysis & Rule
Medium CVE-2026-2312 in Media Library Plus (CVSS 4.3): Media Library Folders. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.3.7.
March 18, 2026
CVE-2026-1249: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 5.10 Authenticated (Author+) Server-Side Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2026-1249 in Mp3 Music Player By Sonaar (CVSS 5.0): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF...
March 18, 2026
CVE-2026-1843: Super Page Cache <= 5.2.2 Unauthenticated Stored Cross-Site Scripting via Activity Log PoC, Patch Analysis & Rule
High CVE-2026-1843 in Wp Cloudflare Page Cache (CVSS 7.2): Super Page Cache. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.2.3.
March 18, 2026
CVE-2025-8572: Truelysell Core <= 1.8.7 Unauthenticated Privilege Escalation via Registration PoC, Patch Analysis & Rule
Critical CVE-2025-8572 in Truelysell Core (CVSS 9.8): Truelysell Core. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1254: Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing PoC, Patch Analysis & Rule
Medium CVE-2026-1254 in Modula Best Grid Gallery (CVSS 4.3): Modula Image Gallery – Photo Grid & Video Gallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.13.7.
March 18, 2026
CVE-2025-15483: Link Hopper <= 2.5 Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-15483 in Link Hopper (CVSS 4.4): Link Hopper. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0550: myCred <= 2.9.7.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0550 in Mycred (CVSS 6.4): myCred. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.9.7.4.
March 18, 2026
CVE-2026-1258: Mail Mint <= 1.19.2 Authenticated (Administrator+) SQL Injection via Multiple API Endpoints PoC, Patch Analysis & Rule
Medium CVE-2026-1258 in Mail Mint (CVSS 4.9): Mail Mint. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.19.3.
March 18, 2026
CVE-2026-1792: Geo Widet <= 1.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1792 in Geowidget (CVSS 6.1): Geo Widet. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1306: midi-Synth <= 1.1.0 Unauthenticated Arbitrary File Upload via 'export' AJAX Action PoC, Patch Analysis & Rule
Critical CVE-2026-1306 in Midi Synth (CVSS 9.8): midi-Synth. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1910: UpMenu <= 3.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1910 in Upmenu (CVSS 6.4): UpMenu. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0736: Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.8 Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field PoC, Patch Analysis & Rule
Medium CVE-2026-0736 in Collectchat (CVSS 6.4): Chatbot for WordPress by Collect.chat ⚡️. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.9.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.