AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1988: Flexi Product Slider and Grid for WooCommerce <= 1.0.5 Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute PoC, Patch Analysis & Rule
High CVE-2026-1988 in Flexi Product Slider Grid (CVSS 7.5): Flexi Product Slider and Grid for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0557: WP Data Access <= 5.5.63 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0557 in Wp Data Access (CVSS 6.4): WP Data Access. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.5.64.
March 18, 2026
CVE-2026-0693: Allow HTML in Category Descriptions <= 1.2.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions PoC, Patch Analysis & Rule
Medium CVE-2026-0693 in Allow Html In Category Descriptions (CVSS 4.4): Allow HTML in Category Descriptions. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.5.
March 18, 2026
CVE-2025-6792: One to one user Chat by WPGuppy <= 1.1.4 Unauthenticated Information Disclosure via Chat Message Interception PoC, Patch Analysis & Rule
Medium CVE-2025-6792 in Wpguppy Lite (CVSS 5.3): One to one user Chat by WPGuppy. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.5.
March 18, 2026
CVE-2026-1187: ZoomifyWP Free <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1187 in Tz Zoomifywp Free (CVSS 6.4): ZoomifyWP Free. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1932: Appointment Booking Calendar Plugin <= 1.0.2 Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification PoC, Patch Analysis & Rule
Medium CVE-2026-1932 in Bookr (CVSS 5.3): Appointment Booking Calendar Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2024: PhotoStack Gallery <= 0.4.1 Unauthenticated SQL Injection via 'postid' Parameter PoC, Patch Analysis & Rule
High CVE-2026-2024 in Photostack Gallery (CVSS 7.5): PhotoStack Gallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1754: personal-authors-category <= 0.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-1754 in Personal Authors Category (CVSS 6.1): personal-authors-category. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1915: Simple Plyr <= 0.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1915 in Simple Plyr (CVSS 6.4): Simple Plyr. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2144: Magic Login Mail or QR Code <= 2.05 Unauthenticated Privilege Escalation via Insecure QR Code File Storage PoC, Patch Analysis & Rule
High CVE-2026-2144 in Magic Login Mail (CVSS 8.1): Magic Login Mail or QR Code. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1904: Simple Wp colorfull Accordion <= 1.0 Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1904 in Simple Wp Colorfull Accordion (CVSS 6.4): Simple Wp colorfull Accordion. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2027: AMP Enhancer <= 1.0.49 Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting PoC, Patch Analysis & Rule
Medium CVE-2026-2027 in Amp Enhancer (CVSS 4.4): AMP Enhancer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1983: SEATT: Simple Event Attendance <= 1.5.0 Cross-Site Request Forgery to Arbitrary Event Deletion PoC, Patch Analysis & Rule
Medium CVE-2026-1983 in Simple Event Attendance (CVSS 4.3): SEATT: Simple Event Attendance. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0692: BlueSnap Payment Gateway for WooCommerce <= 3.4.0 Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation PoC, Patch Analysis & Rule
High CVE-2026-0692 in Bluesnap Payment Gateway For Woocommerce (CVSS 7.5): BlueSnap Payment Gateway for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.4.1.
March 18, 2026
CVE-2025-13973: StickEasy Protected Contact Form <= 1.0.1 Unauthenticated Information Disclosure PoC, Patch Analysis & Rule
Medium CVE-2025-13973 in Stickeasy Protected Contact Form (CVSS 5.3): StickEasy Protected Contact Form. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.2.
March 18, 2026
CVE-2025-15157: Starfish Review Generation & Marketing for WordPress <= 3.1.19 Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults PoC, Patch Analysis & Rule
High CVE-2025-15157 in Starfish Reviews (CVSS 8.8): Starfish Review Generation & Marketing for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.20.
March 18, 2026
CVE-2026-1912: Citations tools <= 0.3.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1912 in Citations Tools (CVSS 6.4): Citations tools. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13681: BFG Tools – Extension Zipper <= 1.0.7 Authenticated (Administrator+) Path Traversal via 'first_file' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13681 in Bfg Tools Extension Zipper (CVSS 4.9): BFG Tools – Extension Zipper. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.8.
March 18, 2026
CVE-2026-1164: Easy Voice Mail <= 1.2.5 Unauthenticated Stored Cross-Site Scripting via 'message' PoC, Patch Analysis & Rule
Medium CVE-2026-1164 in Easy Voice Mail (CVSS 6.1): Easy Voice Mail. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-14067: Easy Form Builder <= 3.9.3 Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-14067 in Easy Form Builder (CVSS 5.3): Easy Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.4.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.