AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
July 7, 2026
CVE-2026-6820: VikBooking Hotel Booking Engine & PMS <= 1.8.8 Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field PoC, Patch Analysis & Rule
High CVE-2026-6820 in Vikbooking (CVSS 7.2): VikBooking Hotel Booking Engine & PMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.9.
July 7, 2026
CVE-2026-6459: Essential Addons for Elementor <= 6.6.2 Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup PoC, Patch Analysis & Rule
Medium CVE-2026-6459 in Essential Addons For Elementor Lite (CVSS 6.4): Essential Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.6.3.
July 7, 2026
CVE-2026-6818: VikBooking Hotel Booking Engine & PMS <= 1.8.8 Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6818 in Vikbooking (CVSS 7.2): VikBooking Hotel Booking Engine & PMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.9.
July 7, 2026
CVE-2025-14785: Website Builder by SeedProd Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-14785 in Coming Soon (CVSS 6.4): Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.20.3.
July 7, 2026
CVE-2026-3688: WCFM WooCommerce Multivendor Membership <= 2.11.10 Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite PoC, Patch Analysis & Rule
High CVE-2026-3688 in Wc Multivendor Membership (CVSS 8.1): WCFM - WooCommerce Multivendor Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.11.11.
July 7, 2026
CVE-2026-6742: Advanced iFrame <= 2026.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6742 in Advanced Iframe (CVSS 6.4): Advanced iFrame. Atomic Edge summarizes impact, exploitability, and patch details.
July 7, 2026
CVE-2026-5356: LatePoint Calendar Booking Plugin for Appointments and Events <= 5.4.0 Unauthenticated Stripe PaymentIntent Amount-Binding Bypass PoC, Patch Analysis & Rule
High CVE-2026-5356 in Latepoint (CVSS 7.5): LatePoint - Calendar Booking Plugin for Appointments and Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.1.
July 7, 2026
CVE-2026-6854: My Calendar <= 3.7.8 Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters PoC, Patch Analysis & Rule
High CVE-2026-6854 in My Calendar (CVSS 7.5): My Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-6230: Tainacan <= 1.0.3 Unauthenticated SQL Injection via 'geoquery' REST API Parameter PoC, Patch Analysis & Rule
High CVE-2026-6230 in Tainacan (CVSS 7.5): Tainacan. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.0.
July 7, 2026
CVE-2026-11798: Social Share, Social Login and Social Comments Plugin <= 7.14.5 Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-11798 in Super Socializer (CVSS 6.1): Social Share, Social Login and Social Comments Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-14250: Themehunk Login Registration <= 1.0.2 Unauthenticated Privilege Escalation via 'role' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-14250 in Themehunk Login Registration (CVSS 6.3): Themehunk Login Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.3.
July 7, 2026
CVE-2026-14489: WHMCS Bridge <= 6.9 Unauthenticated Arbitrary File Upload via 'ccce' Parameter PoC, Patch Analysis & Rule
High CVE-2026-14489 in Whmcs Bridge (CVSS 8.8): WHMCS Bridge. Atomic Edge summarizes impact, exploitability, and patch details.
July 7, 2026
CVE-2026-12936: Recurio <= 1.1.3 Authenticated (Shop Manager+) SQL Injection via 'data' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12936 in Recurio (CVSS 4.9): Recurio. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.4.
July 7, 2026
CVE-2026-12153: WP Learn Manager <= 1.1.8 Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action PoC, Patch Analysis & Rule
Critical CVE-2026-12153 in Learn Manager (CVSS 9.8): WP Learn Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-12097: User Management <= 1.2 Missing Authorization to Unauthenticated Plugin Settings Modification PoC, Patch Analysis & Rule
Medium CVE-2026-12097 in User Management (CVSS 5.3): User Management. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-14495: DoLogin Security <= 4.3 Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token PoC, Patch Analysis & Rule
High CVE-2026-14495 in Dologin (CVSS 8.8): DoLogin Security. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-12041: Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 Authenticated (Administrator+) Stored Cross-Site Scripting via 'chatra-code' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-12041 in Chatra Live Chat (CVSS 4.4): Chatra Live Chat + ChatBot + Cart Saver. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2025-14169: FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-14169 in Funnel Builder (CVSS 7.5): FunnelKit – Funnel Builder for WooCommerce Checkout. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.13.1.6.
July 6, 2026
CVE-2026-14345: WPFunnels <= 3.12.7 Unauthenticated Remote Code Execution via 'postData' Parameter PoC, Patch Analysis & Rule
Critical CVE-2026-14345 in Wpfunnels (CVSS 9.8): WPFunnels. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.12.8.
July 6, 2026
CVE-2025-64636: Donation Thermometer <= 2.2.7 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2025-64636 in Donation Thermometer (CVSS 5.3): Donation Thermometer. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.2.8.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.