AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1985: Press3D <= 1.0.2 Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block PoC, Patch Analysis & Rule
Medium CVE-2026-1985 in Press3d (CVSS 6.4): Press3D. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.0.
March 18, 2026
CVE-2026-1903: Ravelry Designs Widget <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1903 in Ravelry Designs Widget (CVSS 6.4): Ravelry Designs Widget. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2022: Smart Forms <= 2.6.99 Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-2022 in Smart Forms (CVSS 4.3): Smart Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0745: User Language Switch <= 1.6.10 Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter PoC, Patch Analysis & Rule
High CVE-2026-0745 in User Language Switch (CVSS 7.2): User Language Switch. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1394: WP Quick Contact Us <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1394 in Wp Quick Contact Us (CVSS 4.3): WP Quick Contact Us. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0735: User Language Switch <= 1.6.10 Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0735 in User Language Switch (CVSS 4.4): User Language Switch. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14852: MDirector Newsletter <= 4.5.8 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2025-14852 in Mdirector Newsletter (CVSS 4.3): MDirector Newsletter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.10.
March 18, 2026
CVE-2026-1303: MailChimp Campaigns <= 3.2.4 Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection PoC, Patch Analysis & Rule
Medium CVE-2026-1303 in Olalaweb Mailchimp Campaign Manager (CVSS 5.3): MailChimp Campaigns. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0751: Payment Page | Payment Form for Stripe <= 1.4.6 Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0751 in Payment Page (CVSS 6.4): Payment Page | Payment Form for Stripe. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.7.
March 18, 2026
CVE-2026-1987: Scheduler Widget <= 0.1.6 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1987 in Scheduler Widget (CVSS 5.4): Scheduler Widget. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1795: Address Bar Ads <= 1.0.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1795 in Address Bar Ads (CVSS 6.1): Address Bar Ads. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1796: StyleBidet <= 1.0.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1796 in Stylebidet (CVSS 6.1): StyleBidet. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1939: Percent to Infograph <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1939 in Percent To Infograph (CVSS 6.4): Percent to Infograph. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1901: QuestionPro Surveys <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1901 in Questionpro Surveys (CVSS 6.4): QuestionPro Surveys. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0753: Super Simple Contact Form <= 1.6.2 Reflected Cross-Site Scripting via 'sscf_name' Parameter PoC, Patch Analysis & Rule
High CVE-2026-0753 in Super Simple Contact Form (CVSS 7.2): Super Simple Contact Form. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1944: CallbackKiller service widget <= 1.2 Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1944 in Callbackkiller Service Widget (CVSS 5.3): CallbackKiller service widget. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14873: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 Cross-Site Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2025-14873 in Latepoint (CVSS 4.3): LatePoint – Calendar Booking Plugin for Appointments and Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.2.6.
March 18, 2026
CVE-2026-1905: Sphere Manager <= 1.0.2 Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1905 in Sphere Manager (CVSS 6.4): Sphere Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0559: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0559 in Masterstudy Lms Learning Management System (CVSS 6.4): MasterStudy LMS WordPress Plugin – for Online Courses and Education. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2026-0727: Accordion and Accordion Slider <= 1.4.5 Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification PoC, Patch Analysis & Rule
Medium CVE-2026-0727 in Accordion And Accordion Slider (CVSS 5.4): Accordion and Accordion Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.6.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.