AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-1809: HTML Shortcodes <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1809 in Html Shortcodes (CVSS 6.4): HTML Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1826: OpenPOS Lite <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1826 in Wpos Lite Version (CVSS 6.4): OpenPOS Lite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.
March 18, 2026
CVE-2026-28114: WooCommerce License Manager <= 7.0.6 Authenticated (Shop Manager+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2026-28114 in Fs License Manager (CVSS 7.2): WooCommerce License Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-28126: RH Frontend Publishing Pro <= 4.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-28126 in Rh Frontend (CVSS 6.1): RH Frontend Publishing Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1311: Worry Proof Backup <= 0.2.4 Authenticated (Subscriber+) Path Traversal via Backup Upload PoC, Patch Analysis & Rule
High CVE-2026-1311 in Worry Proof Backup (CVSS 8.8): Worry Proof Backup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2356: User Registration & Membership <= 5.1.2 Insecure Direct Object Reference to Unauthenticated Limited User Deletion PoC, Patch Analysis & Rule
Medium CVE-2026-2356 in User Registration (CVSS 5.3): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.3.
March 18, 2026
CVE-2026-1565: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2026-1565 in Wp User Frontend (CVSS 8.8): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2026-1779: User Registration & Membership <= 5.1.2 Authentication Bypass PoC, Patch Analysis & Rule
High CVE-2026-1779 in User Registration (CVSS 8.1): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.3.
March 18, 2026
CVE-2026-2489: TP2WP Importer <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea PoC, Patch Analysis & Rule
Medium CVE-2026-2489 in Tp2wp Importer (CVSS 4.4): TP2WP Importer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1557: WP Responsive Images <= 1.0 Unauthenticated Path Traversal to Arbitrary File Read via src PoC, Patch Analysis & Rule
High CVE-2026-1557 in Wp Responsive Images (CVSS 7.5): WP Responsive Images. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2029: Livemesh Addons for Beaver Builder <= 3.9.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-2029 in Addons For Beaver Builder (CVSS 6.4): Livemesh Addons for Beaver Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-2498: WP Social Meta <= 1.0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings PoC, Patch Analysis & Rule
Medium CVE-2026-2498 in Wp Social Meta (CVSS 4.4): WP Social Meta. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1833: WaMate Confirm <= 2.0.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking PoC, Patch Analysis & Rule
Medium CVE-2026-1833 in Wamate Confirm (CVSS 5.3): WaMate Confirm. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1786: Twitter posts to Blog <= 1.11.25 Missing Authorization to Unauthenticated Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1786 in Twitter Posts To Blog (CVSS 6.5): Twitter posts to Blog. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-0815: Category Image <= 2.0 Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0815 in Category Image (CVSS 4.4): Category Image. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2026-1821: Microtango <= 0.9.29 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1821 in Microtango (CVSS 6.4): Microtango. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.9.30.
March 18, 2026
CVE-2026-1357: Migration, Backup, Staging <= 0.9.123 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-1357 in Wpvivid Backuprestore (CVSS 9.8): Migration, Backup, Staging. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 0.9.124.
March 18, 2026
CVE-2025-15524: Gallery by FooGallery <= 3.1.9 Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-15524 in Foogallery (CVSS 4.3): Gallery by FooGallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 18, 2026
CVE-2025-13431: SlimStat Analytics <= 5.3.1 Authenticated (Subscriber+) SQL Injection via `args` Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-13431 in Wp Slimstat (CVSS 6.5): SlimStat Analytics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.2.
March 18, 2026
CVE-2026-1231: Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.0.5 Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings PoC, Patch Analysis & Rule
Medium CVE-2026-1231 in Beaver Builder Lite Version (CVSS 6.4): Beaver Builder Page Builder – Drag and Drop Website Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.