AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 2, 2026
CVE-2026-9723: Google Plus One Bottom <= 0.0.2 Cross-Site Request Forgery to Plugin Settings Update via Settings Page PoC, Patch Analysis & Rule
Medium CVE-2026-9723 in Google Plus One Bottom (CVSS 4.3): Google Plus One Bottom. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 2, 2026
CVE-2026-8885: DeMomentSomTres Shortcodes <= 1.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-8885 in Demomentsomtres Shortcodes (CVSS 6.4): DeMomentSomTres Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-6895: Wishlist Member <= 3.30.1 Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action PoC, Patch Analysis & Rule
High CVE-2026-6895 in Wishlist Member X (CVSS 8.8): Wishlist Member. Atomic Edge summarizes impact, exploitability, and patch details.
May 22, 2026
CVE-2026-6897: Wishlist Member <= 3.30.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action PoC, Patch Analysis & Rule
High CVE-2026-6897 in Wishlist Member X (CVSS 8.8): Wishlist Member. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-6898: WishList Member <= 3.30.1 Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action PoC, Patch Analysis & Rule
High CVE-2026-6898 in Wishlist Member X (CVSS 8.8): WishList Member. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-9284: WooCommerce PayPal Payments <= 4.0.1 Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure PoC, Patch Analysis & Rule
High CVE-2026-9284 in Woocommerce Paypal Payments (CVSS 8.2): WooCommerce PayPal Payments. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.0.2.
May 22, 2026
CVE-2026-6419: Wishlist Member <= 3.30.1 Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action PoC, Patch Analysis & Rule
High CVE-2026-6419 in Wishlist Member X (CVSS 8.8): Wishlist Member. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-6072: Oliver POS <= 2.4.2.6 Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header PoC, Patch Analysis & Rule
Medium CVE-2026-6072 in Oliver Pos (CVSS 6.5): Oliver POS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-8038: Faces of Users <= 0.0.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-8038 in Faces Of Users (CVSS 6.4): Faces of Users. Atomic Edge summarizes impact, exploitability, and patch details.
May 22, 2026
CVE-2026-5293: 診断ジェネレータ作成プラグイン <= 1.4.16 Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5293 in Os Diagnosis Generator (CVSS 6.4): 診断ジェネレータ作成プラグイン. Atomic Edge summarizes impact, exploitability, and patch details.
May 22, 2026
CVE-2026-8073: Kirki <= 6.0.6 Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP PoC, Patch Analysis & Rule
High CVE-2026-8073 in Kirki (CVSS 7.5): Kirki. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.0.7.
May 22, 2026
CVE-2026-45442: The Ultimate Video Player For WordPress – by Presto Player <= 4.1.3 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-45442 in Presto Player (CVSS 5.3): The Ultimate Video Player For WordPress – by Presto Player. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.1.4.
May 22, 2026
CVE-2026-8096: Kirki <= 6.0.6 Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action PoC, Patch Analysis & Rule
Medium CVE-2026-8096 in Kirki (CVSS 6.5): Kirki. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.0.7.
May 22, 2026
CVE-2026-42679: Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 Authenticated (Subscriber+) Arbitrary File Download PoC, Patch Analysis & Rule
Medium CVE-2026-42679 in Classified Listing (CVSS 4.3): Classified Listing – AI-Powered Classified ads & Business Directory Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.3.9.
May 22, 2026
CVE-2026-42680: Contest Gallery Pro <= 29.0.1 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
Critical CVE-2026-42680 in Contest Gallery Pro (CVSS 9.8): Contest Gallery Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-45438: Smart Coupons For WooCommerce Coupons < 2.3.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-45438 in Wt Smart Coupons For Woocommerce (CVSS 5.3): Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.3.0.
May 22, 2026
CVE-2026-42675: Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-42675 in Hydra Booking (CVSS 5.3): Hydra Booking — Appointment Scheduling & Booking Calendar. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.42.
May 22, 2026
CVE-2026-42678: GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-42678 in Give (CVSS 7.2): GiveWP – Donation Plugin and Fundraising Platform. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.14.6.
May 22, 2026
CVE-2026-42677: WP Document Revisions <= 3.8.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-42677 in Wp Document Revisions (CVSS 5.3): WP Document Revisions. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.0.0.
May 22, 2026
CVE-2026-42676: Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 3.0.4 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-42676 in Mycred (CVSS 6.4): Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.0.5.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.