AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
July 3, 2026
CVE-2026-9180: MotoPress Appointment Booking <= 2.4.4 Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-9180 in Motopress Appointment Lite (CVSS 5.3): MotoPress Appointment Booking. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.5.
July 3, 2026
CVE-2026-9756: GenerateBlocks <= 2.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-9756 in Generateblocks (CVSS 6.4): GenerateBlocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.3.0.
July 3, 2026
CVE-2026-11600: Envo’s Templates & Widgets for Elementor and WooCommerce <= 1.4.26 Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-11600 in Envo Elementor For Woocommerce (CVSS 4.3): Envo's Templates & Widgets for Elementor and WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.4.27.
July 3, 2026
CVE-2026-11380: JetWidgets For Elementor <= 1.0.21 Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-11380 in Jetwidgets For Elementor (CVSS 6.4): JetWidgets For Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.22.
July 3, 2026
CVE-2026-12110: Taskbuilder <= 5.0.8 Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12110 in Taskbuilder (CVSS 6.5): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.0.9.
July 3, 2026
CVE-2026-7517: Custom Payment Gateways for WooCommerce <= 2.1.0 Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter PoC, Patch Analysis & Rule
High CVE-2026-7517 in Custom Payment Gateways Woocommerce (CVSS 7.2): Custom Payment Gateways for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.2.0.
July 3, 2026
CVE-2026-12090: Taskbuilder <= 5.0.8 Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12090 in Taskbuilder (CVSS 6.5): Taskbuilder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.0.9.
July 3, 2026
CVE-2026-5524: Divi Form Builder <= 5.1.8 Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter PoC, Patch Analysis & Rule
Critical CVE-2026-5524 in Divi Form Builder (CVSS 9.8): Divi Form Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 3, 2026
CVE-2026-2387: Event Organiser <= 3.12.9 Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-2387 in Event Organiser (CVSS 6.4): Event Organiser. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.12.10.
July 3, 2026
CVE-2026-13015: WP Google Review Slider <= 18.1 Reflected Cross-Site Scripting via 'place' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-13015 in Wp Google Places Review Slider (CVSS 6.1): WP Google Review Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 18.2.
July 3, 2026
CVE-2026-13731: WPBot <= 8.4.9 Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter PoC, Patch Analysis & Rule
High CVE-2026-13731 in Chatbot (CVSS 7.2): WPBot. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.5.0.
July 3, 2026
CVE-2026-12135: FV Flowplayer Video Player <= 7.5.51.7212 Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-12135 in Fv Wordpress Flowplayer (CVSS 6.4): FV Flowplayer Video Player. Atomic Edge summarizes impact, exploitability, and patch details.
July 3, 2026
CVE-2026-13468: Visualizer <= 4.0.3 Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint PoC, Patch Analysis & Rule
High CVE-2026-13468 in Visualizer (CVSS 7.5): Visualizer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.4.
July 3, 2026
CVE-2026-12923: Video Gallery <= 4.0.3 Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter PoC, Patch Analysis & Rule
High CVE-2026-12923 in Youtube Showcase (CVSS 7.5): Video Gallery. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.0.4.
July 3, 2026
CVE-2026-9107: Kali Forms <= 2.4.13 Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-9107 in Kali Forms (CVSS 6.4): Kali Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.14.
July 3, 2026
CVE-2026-13443: Tutor LMS <= 3.9.13 Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title PoC, Patch Analysis & Rule
Medium CVE-2026-13443 in Tutor (CVSS 6.4): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.14.
July 2, 2026
CVE-2026-11398: LatePoint <= 5.6.1 Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step PoC, Patch Analysis & Rule
Medium CVE-2026-11398 in Latepoint (CVSS 5.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.6.2.
July 2, 2026
CVE-2026-5137: RTMKit <= 2.0.7 Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5137 in Rometheme For Elementor (CVSS 4.3): RTMKit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.8.
July 2, 2026
CVE-2026-11900: Ad Inserter <= 2.8.16 Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-11900 in Ad Inserter (CVSS 4.3): Ad Inserter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.8.17.
July 2, 2026
CVE-2026-9230: Quiz and Survey Master (QSM) <= 11.1.4 Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure PoC, Patch Analysis & Rule
Medium CVE-2026-9230 in Quiz Master Next (CVSS 4.3): Quiz and Survey Master (QSM). Atomic Edge summarizes impact, exploitability, and patch details. Update to 11.1.5.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.