AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 22, 2026
CVE-2026-48875: JetSmartFilters <= 3.8.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
CVE-2026-48875 affects the Jet Smart Filters plugin for WordPress (up to v3.8.1) with a CVSS score of 7.5. This high-severity SQL injection vulnerability allows unauthenticated attackers to extract sensitive data. Patch immediately.
June 22, 2026
CVE-2026-48868: Simple Shopping Cart <= 5.2.9 Unauthenticated Insecure Direct Object Reference PoC, Patch Analysis & Rule
CVE-2026-48868 affects the WordPress Simple Paypal Shopping Cart plugin (up to v5.2.9) with a medium severity (CVSS 5.3) IDOR vulnerability. Update to v5.3.0 to mitigate unauthorized access to user shopping carts.
June 22, 2026
CVE-2026-48874: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
CVE-2026-48874 affects the GamiPress plugin (up to v7.8.7) with a CVSS score of 6.5. Authenticated attackers can exploit SQL injection to access sensitive data. Update to v7.8.8 to mitigate this vulnerability.
June 22, 2026
CVE-2026-48870: King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-48870 affects King Addons for Elementor versions up to 51.1.62, allowing authenticated attackers to exploit stored XSS. Upgrade to 51.1.63 to mitigate this medium severity issue with a CVSS score of 6.4.
June 22, 2026
CVE-2026-48881: TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-48881 in Truebooker Appointment Booking (CVSS 5.3): TrueBooker – Appointment Booking and Scheduler System. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.2.0.
June 22, 2026
CVE-2026-48885: HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-48885 affects the Holler Box plugin for WordPress (up to version 2.3.10.1) with a high severity CVSS score of 7.2 due to stored XSS. Upgrade to version 2.3.11 to mitigate this vulnerability.
June 22, 2026
CVE-2026-28116: Progress Planner <= 1.9.0 Authenticated (Editor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-28116 in Progress Planner (CVSS 4.4): Progress Planner. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.9.1.
June 22, 2026
CVE-2026-27351: Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-27351 in Hr Management (CVSS 4.3): Employee, Leave and Recruitment Management System – Crew HRM. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.3.
June 22, 2026
CVE-2026-9599: Tectite Forms <= 1.3 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-9599 in Tectite Forms (CVSS 4.3): Tectite Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 22, 2026
CVE-2026-48873: Montonio for WooCommerce <= 10.1.2 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-48873 in Montonio For Woocommerce (CVSS 5.3): Montonio for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 10.1.3.
June 22, 2026
CVE-2026-9234: JTL-Connector for WooCommerce <= 2.4.1 Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions PoC, Patch Analysis & Rule
Medium CVE-2026-9234 in Woo Jtl Connector (CVSS 4.3): JTL-Connector for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.4.2.
June 22, 2026
CVE-2026-8422: Remove meta boxes per user role <= 1.01 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-8422 in Remove Meta Boxes Per User Role (CVSS 4.3): Remove meta boxes per user role. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 22, 2026
CVE-2026-9050: Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation PoC, Patch Analysis & Rule
Medium CVE-2026-9050 in Revslider (CVSS 4.3): Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 22, 2026
CVE-2026-27395: Support Board < 3.8.9 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
Critical CVE-2026-27395 in Supportboard (CVSS 9.8): Support Board < 3.8.9 - Unauthenticated Privilege Escalation. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 22, 2026
CVE-2026-3722: Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3722 in Auto Image Attributes From Filename With Bulk Updater (CVSS 6.4): Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO). Atomic Edge summarizes impact, exploitability...
June 22, 2026
CVE-2026-48865: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-48865 in Learnpress (CVSS 6.1): LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.7.
June 22, 2026
CVE-2026-9048: Slider Revolution 7.0.0 7.0.14 Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-9048 in Revslider (CVSS 4.3): Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 22, 2026
CVE-2026-42762: VikBooking Hotel Booking Engine & PMS <= 1.8.9 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-42762 in Vikbooking (CVSS 7.2): VikBooking Hotel Booking Engine & PMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.8.10.
June 21, 2026
CVE-2026-48967: Geo Mashup <= 1.13.19 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2026-48967 in Geo Mashup (CVSS 6.5): Geo Mashup. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.13.20.
June 21, 2026
CVE-2026-8653: MasterStudy LMS Pro Plus <= 4.8.20 Authenticated (Instructor+) SQL Injection via 'columns' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-8653 in Masterstudy Lms Learning Management System Pro (CVSS 6.5): MasterStudy LMS Pro Plus. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.