AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 22, 2026
CVE-2026-42672: WP Directory Kit <= 1.5.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-42672 in Wpdirectorykit (CVSS 7.5): WP Directory Kit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 22, 2026
CVE-2026-42674: Advanced Access Manager – Access Governance for WordPress <= 7.1.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-42674 in Advanced Access Manager (CVSS 5.3): Advanced Access Manager – Access Governance for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.1.1.
May 21, 2026
CVE-2026-7615: Widget Context <= 1.3.3 Cross-Site Request Forgery to Settings Update via 'wl' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7615 in Widget Context (CVSS 4.3): Widget Context. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.4.0.
May 21, 2026
CVE-2026-8679: AudioIgniter Music Player <= 2.0.2 Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter PoC, Patch Analysis & Rule
High CVE-2026-8679 in Audioigniter (CVSS 7.5): AudioIgniter Music Player. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.3.
May 21, 2026
CVE-2026-8692: Vedrixa Forms <= 1.1.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-8692 in Vedrixa Forms Registration Builder (CVSS 4.3): Vedrixa Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.2.0.
May 21, 2026
CVE-2026-8684: MotoPress Hotel Booking <= 6.0.1 Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-8684 in Motopress Hotel Booking Lite (CVSS 5.3): MotoPress Hotel Booking. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.0.2.
May 21, 2026
CVE-2026-7636: Slider by Soliloquy <= 2.8.1 Authenticated (Subscriber+) Information Disclosure via REST API Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-7636 in Soliloquy Lite (CVSS 4.3): Slider by Soliloquy. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.8.2.
May 21, 2026
CVE-2026-3481: WP Blockade <= 0.9.14 Reflected Cross-Site Scripting via 'shortcode' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3481 in Wp Blockade (CVSS 6.1): WP Blockade. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-4070: Alfie <= 1.2.1 Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4070 in Alfie The Productfeedtool Wp Plugin (CVSS 4.3): Alfie. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-9011: Ditty <= 3.1.65 Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action PoC, Patch Analysis & Rule
High CVE-2026-9011 in Ditty News Ticker (CVSS 7.5): Ditty. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.66.
May 21, 2026
CVE-2026-9104: Draft List <= 2.6.3 Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title PoC, Patch Analysis & Rule
Medium CVE-2026-9104 in Simple Draft List (CVSS 6.4): Draft List. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.6.4.
May 21, 2026
CVE-2026-9018: Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 Unauthenticated Privilege Escalation via 'custom_meta' Parameter PoC, Patch Analysis & Rule
High CVE-2026-9018 in Easy Elements (CVSS 8.8): Easy Elements for Elementor – Addons & Website Templates. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 21, 2026
CVE-2026-7798: FluentCRM <= 2.9.87 Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7798 in Fluent Crm (CVSS 5.4): FluentCRM. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.0.
May 21, 2026
CVE-2026-7509: KIA Subtitle <= 4.0.1 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] PoC, Patch Analysis & Rule
Medium CVE-2026-7509 in Kia Subtitle (CVSS 6.4): KIA Subtitle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.2.
May 21, 2026
CVE-2026-7249: Location Weather <= 3.0.2 Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging PoC, Patch Analysis & Rule
Medium CVE-2026-7249 in Location Weather (CVSS 4.3): Location Weather. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.0.3.
May 21, 2026
CVE-2026-6864: CBX 5 Star Rating & Review <= 1.0.7 Reflected Cross-Site Scripting via 'page' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6864 in Cbxscratingreview (CVSS 6.1): CBX 5 Star Rating & Review. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.8.
May 21, 2026
CVE-2026-4834: WP ERP Pro <= 1.5.1 Unauthenticated SQL Injection via 'search_key' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4834 in Erp Pro (CVSS 7.5): WP ERP Pro. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-6555: ProSolution WP Client <= 2.0.0 Unauthenticated Arbitrary File Upload via 'files' PoC, Patch Analysis & Rule
Critical CVE-2026-6555 in Prosolution Wp Client (CVSS 9.8): ProSolution WP Client. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.0.1.
May 21, 2026
CVE-2026-4843: GSheet For Woo Importer <= 2.3.1 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset PoC, Patch Analysis & Rule
Medium CVE-2026-4843 in Import Products From Gsheet For Woo Importer (CVSS 4.3): GSheet For Woo Importer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.1.
May 21, 2026
CVE-2026-6960: BookingPress Pro <= 5.6 Unauthenticated Arbitrary File Upload via Signature Custom Field PoC, Patch Analysis & Rule
Critical CVE-2026-6960 in Bookingpress Appointment Booking Pro (CVSS 9.8): BookingPress Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.