AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 15, 2026
CVE-2026-6690: LifePress <= 2.2.2 Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action PoC, Patch Analysis & Rule
High CVE-2026-6690 in Lifepress (CVSS 7.2): LifePress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 15, 2026
CVE-2026-6256: Credits Shortcode <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6256 in Source Shortcode (CVSS 6.4): Credits Shortcode. Atomic Edge summarizes impact, exploitability, and patch details.
May 14, 2026
CVE-2026-6403: Quick Playground <= 1.3.3 Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6403 in Quick Playground (CVSS 7.5): Quick Playground. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.4.
May 14, 2026
CVE-2026-6228: Frontend Admin by DynamiApps <= 3.28.36 Unauthenticated Privilege Escalation via Edit User Form PoC, Patch Analysis & Rule
High CVE-2026-6228 in Acf Frontend Form Element (CVSS 8.8): Frontend Admin by DynamiApps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.29.1.
May 14, 2026
CVE-2026-7046: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 Authenticated (Administrator+) SQL Injection via 'table' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7046 in Nex Forms Express Wp Form Builder (CVSS 4.9): NEX-Forms – Ultimate Forms Plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 9.1.13.
May 14, 2026
CVE-2026-7563: Classified Listing <= 5.3.10 Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions PoC, Patch Analysis & Rule
Medium CVE-2026-7563 in Classified Listing (CVSS 4.3): Classified Listing. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.0.
May 14, 2026
CVE-2026-8425: Notify Odoo <= 1.0.1 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-8425 in Notify Odoo (CVSS 4.3): Notify Odoo. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-5229: Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 Unauthenticated Authentication Bypass via LINE OAuth Callback PoC, Patch Analysis & Rule
Critical CVE-2026-5229 in Form Notify (CVSS 9.8): Receive Notifications After Form Submitting – Form Notify for Any Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.11.
May 14, 2026
CVE-2026-4094: FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 Missing Authorization to Authenticated (Contributor+) Configuration Deletion PoC, Patch Analysis & Rule
High CVE-2026-4094 in Woocommerce Currency Switcher (CVSS 8.1): FOX – Currency Switcher Professional for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-4683: Smartcat Translator for WPML <= 3.1.77 Missing Authorization to Unauthenticated Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-4683 in Smartcat Wpml (CVSS 6.5): Smartcat Translator for WPML. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.78.
May 14, 2026
CVE-2026-6415: Advanced Custom Fields: Font Awesome Field <= 5.0.2 Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field PoC, Patch Analysis & Rule
Medium CVE-2026-6415 in Advanced Custom Fields Font Awesome (CVSS 6.4): Advanced Custom Fields: Font Awesome Field. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.0.0.
May 14, 2026
CVE-2026-5396: Fluent Forms <= 6.1.21 Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5396 in Fluentform (CVSS 8.2): Fluent Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.2.0.
May 14, 2026
CVE-2026-8181: Burst Statistics 3.4.0 3.4.1.1 Authentication Bypass to Admin Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2026-8181 in Burst Statistics (CVSS 9.8): Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.4.2.
May 14, 2026
CVE-2026-5361: Envira Gallery <= 1.12.4 Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5361 in Envira Gallery Lite (CVSS 6.4): Envira Gallery. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.12.5.
May 14, 2026
CVE-2026-42668: Omnisend for WooCommerce <= 1.18.0 Unauthenticated Omnisend Account Takeover via Predictable Connect Token PoC, Patch Analysis & Rule
High CVE-2026-42668 in Omnisend Connect (CVSS 7.5): Omnisend for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.18.1.
May 14, 2026
CVE-2026-5486: Unlimited Elements For Elementor <= 2.0.7 Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5486 in Unlimited Elements For Elementor (CVSS 6.5): Unlimited Elements For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-5243: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget PoC, Patch Analysis & Rule
Medium CVE-2026-5243 in The Plus Addons For Elementor Page Builder (CVSS 6.4): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce. Atomic Edge summarizes impact, exploitability, and...
May 14, 2026
CVE-2026-4031: Database Backup for WordPress <= 2.5.2 Missing Authorization to Unauthenticated Database Backup Interception PoC, Patch Analysis & Rule
High CVE-2026-4031 in Wp Db Backup (CVSS 7.5): Database Backup for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.3.
May 14, 2026
CVE-2026-3829: WP Encryption One Click SSL & Force HTTPS <= 7.8.5.10 Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering PoC, Patch Analysis & Rule
Medium CVE-2026-3829 in Wp Letsencrypt Ssl (CVSS 5.4): WP Encryption - One Click SSL & Force HTTPS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.8.5.11.
May 14, 2026
CVE-2026-7525: My Calendar <= 3.7.9 Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7525 in My Calendar (CVSS 4.3): My Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.7.10.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.