AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 18, 2026
CVE-2026-2512: Code Embed <= 2.5.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields PoC, Patch Analysis & Rule
Medium CVE-2026-2512 in Simple Embed Code (CVSS 6.4): Code Embed. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.2.
March 18, 2026
CVE-2026-1463: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 Authenticated (Author+) Local File Inclusion PoC, Patch Analysis & Rule
High CVE-2026-1463 in Nextgen Gallery (CVSS 8.8): Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.5.
March 18, 2026
CVE-2026-2991: KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 Unauthenticated Authentication Bypass via Social Login Token PoC, Patch Analysis & Rule
Critical CVE-2026-2991 in Kivicare Clinic Management System (CVSS 9.8): KiviCare – Clinic & Patient Management System (EHR). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.1.3.
March 18, 2026
CVE-2026-2992: KiviCare <= 4.1.2 Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard PoC, Patch Analysis & Rule
High CVE-2026-2992 in Kivicare Clinic Management System (CVSS 8.2): KiviCare. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.1.3.
March 18, 2026
CVE-2026-1870: Thim Kit for Elementor <= 1.3.7 Missing Authorization to Unauthenticated Private Course Disclosure PoC, Patch Analysis & Rule
Medium CVE-2026-1870 in Thim Elementor Kit (CVSS 5.3): Thim Kit for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.8.
March 18, 2026
CVE-2026-1948: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license PoC, Patch Analysis & Rule
Medium CVE-2026-1948 in Nex Forms Express Wp Form Builder (CVSS 4.3): NEX-Forms – Ultimate Forms Plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.1.10.
March 18, 2026
CVE-2026-1883: Wicked Folders <= 4.1.0 Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion PoC, Patch Analysis & Rule
Medium CVE-2026-1883 in Wicked Folders (CVSS 4.3): Wicked Folders. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.1.1.
March 18, 2026
CVE-2026-1947: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id PoC, Patch Analysis & Rule
High CVE-2026-1947 in Nex Forms Express Wp Form Builder (CVSS 7.5): NEX-Forms – Ultimate Forms Plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.1.10.
March 18, 2026
CVE-2026-4063: Social Icons Widget & Block <= 4.5.8 Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation PoC, Patch Analysis & Rule
Medium CVE-2026-4063 in Social Icons Widget By Wpzoom (CVSS 4.3): Social Icons Widget & Block. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.9.
March 18, 2026
CVE-2026-2233: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2233 in Wp User Frontend (CVSS 5.3): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
March 18, 2026
CVE-2026-2373: Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 Missing Authorization to Unauthenticated Custom Post Type Contents Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-2373 in Royal Elementor Addons (CVSS 5.3): Royal Addons for Elementor – Addons and Templates Kit for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.1050.
March 18, 2026
CVE-2026-2257: GetGenie <= 4.3.2 Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API PoC, Patch Analysis & Rule
Medium CVE-2026-2257 in Getgenie (CVSS 6.4): GetGenie. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-3986: Calculated Fields Form <= 5.4.5.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings PoC, Patch Analysis & Rule
Medium CVE-2026-3986 in Calculated Fields Form (CVSS 6.4): Calculated Fields Form. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.5.1.
March 18, 2026
CVE-2026-2879: GetGenie <= 4.3.2 Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion PoC, Patch Analysis & Rule
Medium CVE-2026-2879 in Getgenie (CVSS 5.4): GetGenie. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.3.
March 18, 2026
CVE-2026-2888: Formidable Forms <= 6.28 Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2888 in Formidable (CVSS 5.3): Formidable Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.29.
March 18, 2026
CVE-2026-2987: Simple Ajax Chat <= 20260217 Unauthenticated Stored Cross-Site Scripting via 'c' PoC, Patch Analysis & Rule
Medium CVE-2026-2987 in Simple Ajax Chat (CVSS 6.1): Simple Ajax Chat. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 20260301.
March 18, 2026
CVE-2026-2890: Formidable Forms <= 6.28 Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse PoC, Patch Analysis & Rule
High CVE-2026-2890 in Formidable (CVSS 7.5): Formidable Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.29.
March 18, 2026
CVE-2026-3045: Appointment Booking Calendar <= 1.6.9.29 Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint PoC, Patch Analysis & Rule
High CVE-2026-3045 in Simply Schedule Appointments (CVSS 7.5): Appointment Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.10.0.
March 18, 2026
CVE-2026-1704: Appointment Booking Calendar <= 1.6.9.29 Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-1704 in Simply Schedule Appointments (CVSS 4.3): Appointment Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.10.0.
March 18, 2026
CVE-2026-3891: Pix for WooCommerce <= 1.5.0 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-3891 in Payment Gateway Pix For Woocommerce (CVSS 9.8): Pix for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.0.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.