AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 11, 2026
CVE-2026-8839: MapPress Maps for WordPress <= 2.96.6 Unauthenticated Insecure Direct Object Reference via REST API Endpoints PoC, Patch Analysis & Rule
Medium CVE-2026-8839 in Mappress Google Maps For Wordpress (CVSS 5.3): MapPress Maps for WordPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.97.1.
June 11, 2026
CVE-2026-7624: SEO Plugin by Squirrly SEO <= 12.4.16 Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations PoC, Patch Analysis & Rule
Medium CVE-2026-7624 in Squirrly Seo (CVSS 4.3): SEO Plugin by Squirrly SEO. Atomic Edge summarizes impact, exploitability, and patch details. Update to 12.4.17.
June 11, 2026
CVE-2026-9125: The Ultimate Video Player For WordPress <= 4.2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-9125 in Presto Player (CVSS 6.4): The Ultimate Video Player For WordPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.2.1.
June 11, 2026
CVE-2026-2500: Quick Playground <= 1.3.4 Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2500 in Quick Playground (CVSS 4.4): Quick Playground. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.5.
June 11, 2026
CVE-2026-7665: Essential Addons for Elementor <= 6.6.4 Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler PoC, Patch Analysis & Rule
Medium CVE-2026-7665 in Essential Addons For Elementor Lite (CVSS 5.3): Essential Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.6.5.
June 11, 2026
CVE-2026-9197: Smart Slider 3 <= 3.5.1.36 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export PoC, Patch Analysis & Rule
Medium CVE-2026-9197 in Smart Slider 3 (CVSS 4.9): Smart Slider 3. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 11, 2026
CVE-2026-7565: LearnPress <= 4.1.4 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7565 in Learnpress Import Export (CVSS 4.9): LearnPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.1.5.
June 11, 2026
CVE-2026-8502: LearnPress <= 4.3.6 Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-8502 in Learnpress (CVSS 5.3): LearnPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.7.
June 11, 2026
CVE-2026-8611: Klamra Paycal for Aspaclaria <= 1.1.4 Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-8611 in Klamra Paycal For Aspaclaria (CVSS 4.3): Klamra Paycal for Aspaclaria. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.5.
June 11, 2026
CVE-2026-7796: EmbedPress <= 4.5.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-7796 in Embedpress (CVSS 6.4): EmbedPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.4.
June 11, 2026
CVE-2026-7792: WPForms <= 1.10.0.4 Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-7792 in Wpforms Lite (CVSS 5.3): WPForms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.10.0.5.
June 11, 2026
CVE-2026-8991: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings PoC, Patch Analysis & Rule
Medium CVE-2026-8991 in Drag And Drop Multiple File Upload Contact Form 7 (CVSS 4.4): Drag and Drop Multiple File Upload for Contact Form 7. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.9.8.
June 11, 2026
CVE-2026-7537: MDJM Event Management <= 1.7.8.3 Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter PoC, Patch Analysis & Rule
High CVE-2026-7537 in Mobile Dj Manager (CVSS 7.2): MDJM Event Management. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.8.4.
June 11, 2026
CVE-2026-7566: LearnPress – Backup & Migration Tool <= 4.1.4 Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload PoC, Patch Analysis & Rule
Medium CVE-2026-7566 in Learnpress Import Export (CVSS 6.6): LearnPress – Backup & Migration Tool. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.1.5.
June 11, 2026
CVE-2026-8978: OptinCraft <= 1.2.0 Authenticated (Administrator+) SQL Injection via 'order_by' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-8978 in Optincraft (CVSS 4.9): OptinCraft. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.1.
June 11, 2026
CVE-2026-9280: Ad Inserter <= 2.8.15 Reflected Cross-Site Scripting via URL Parameters in iframe Mode PoC, Patch Analysis & Rule
Medium CVE-2026-9280 in Ad Inserter (CVSS 6.1): Ad Inserter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.8.16.
June 11, 2026
CVE-2026-7795: Click to Chat <= 4.39 Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7795 in Click To Chat For Whatsapp (CVSS 6.4): Click to Chat. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.40.
June 11, 2026
CVE-2026-9008: Page-list <= 6.2 Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-9008 in Page List (CVSS 4.3): Page-list. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.3.
June 11, 2026
CVE-2026-9281: Master Addons For Elementor <= 3.1.0 Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) PoC, Patch Analysis & Rule
Medium CVE-2026-9281 in Master Addons (CVSS 6.4): Master Addons For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
June 11, 2026
CVE-2026-8901: Integration for Freshsales <= 1.0.15 Unauthenticated Stored Cross-Site Scripting via Form Submission Data PoC, Patch Analysis & Rule
High CVE-2026-8901 in Crm Integration Freshworks Any Form (CVSS 7.2): Integration for Freshsales. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.16.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.