AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 13, 2026
CVE-2026-49112: Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.64 Unauthenticated Path Traversal PoC, Patch Analysis & Rule
Medium CVE-2026-49112 in Shared Files (CVSS 5.3): Shared Files – Frontend File Upload Form & Secure File Sharing. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.65.
June 13, 2026
CVE-2019-25727: 10WebAdManager <= 1.0.11 Unauthenticated Arbitrary File Download PoC, Patch Analysis & Rule
Medium CVE-2019-25727 in Ad Manager Wd (CVSS 5.3): 10WebAdManager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 13, 2026
CVE-2026-49081: User Registration Stripe <= 1.3.12 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-49081 in User Registration Stripe (CVSS 5.3): User Registration Stripe. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 13, 2026
CVE-2026-49085: WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-49085 in Cf7 Insightly (CVSS 8.1): WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.5.
June 12, 2026
CVE-2025-12656: Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 Authenticated (Admin+) Arbitrary Directory Deletion PoC, Patch Analysis & Rule
Low CVE-2025-12656 in Wpvivid Backuprestore (CVSS 3.8): Migration, Backup, Staging – WPvivid Backup & Migration. Atomic Edge summarizes impact, exploitability, and patch details. Update to 0.9.129.
June 12, 2026
CVE-2026-9719: LatePoint <= 5.6.0 Cross-Site Request Forgery via invoices__change_status Action PoC, Patch Analysis & Rule
Medium CVE-2026-9719 in Latepoint (CVSS 4.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.6.1.
June 12, 2026
CVE-2026-8976: RSS Aggregator by Feedzy <= 5.1.7 Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions PoC, Patch Analysis & Rule
Medium CVE-2026-8976 in Feedzy Rss Feeds (CVSS 4.3): RSS Aggregator by Feedzy. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.8.
June 12, 2026
CVE-2026-8438: All-In-One Security (AIOS) <= 5.4.7 Unauthenticated Stored Cross-Site Scripting via REST API Request Path PoC, Patch Analysis & Rule
High CVE-2026-8438 in All In One Wp Security And Firewall (CVSS 7.2): All-In-One Security (AIOS). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.8.
June 12, 2026
CVE-2026-8893: Express Payment For Stripe <= 1.28.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-8893 in Wp Stripe Express (CVSS 6.4): Express Payment For Stripe. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.28.2.
June 12, 2026
CVE-2026-7047: Frontend User Notes <= 2.1.1 Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action PoC, Patch Analysis & Rule
Medium CVE-2026-7047 in Frontend User Notes (CVSS 4.3): Frontend User Notes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.2.0.
June 12, 2026
CVE-2026-10038: Charitable <= 1.8.11.1 Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-10038 in Charitable (CVSS 4.3): Charitable. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.11.2.
June 12, 2026
CVE-2026-8900: Simple SEO Slideshow <= 1.2.8 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-8900 in Simple Seo Slideshow (CVSS 6.4): Simple SEO Slideshow. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 12, 2026
CVE-2026-7523: Alba Board <= 2.1.3 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7523 in Alba Board (CVSS 4.3): Alba Board. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.4.
June 12, 2026
CVE-2026-5415: WP Captcha PRO <= 5.38 Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link PoC, Patch Analysis & Rule
High CVE-2026-5415 in Advanced Google Recaptcha (CVSS 8.8): WP Captcha PRO. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 12, 2026
CVE-2026-8206: Kirki 6.0.0 6.0.6 Unauthenticated Privilege Escalation via ‘handle_forgot_password’ PoC, Patch Analysis & Rule
Critical CVE-2026-8206 in Kirki (CVSS 9.8): Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.0.7.
June 11, 2026
CVE-2026-8839: MapPress Maps for WordPress <= 2.96.6 Unauthenticated Insecure Direct Object Reference via REST API Endpoints PoC, Patch Analysis & Rule
Medium CVE-2026-8839 in Mappress Google Maps For Wordpress (CVSS 5.3): MapPress Maps for WordPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.97.1.
June 11, 2026
CVE-2026-7624: SEO Plugin by Squirrly SEO <= 12.4.16 Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations PoC, Patch Analysis & Rule
Medium CVE-2026-7624 in Squirrly Seo (CVSS 4.3): SEO Plugin by Squirrly SEO. Atomic Edge summarizes impact, exploitability, and patch details. Update to 12.4.17.
June 11, 2026
CVE-2026-9125: The Ultimate Video Player For WordPress <= 4.2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-9125 in Presto Player (CVSS 6.4): The Ultimate Video Player For WordPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.2.1.
June 11, 2026
CVE-2026-2500: Quick Playground <= 1.3.4 Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-2500 in Quick Playground (CVSS 4.4): Quick Playground. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.5.
June 11, 2026
CVE-2026-7665: Essential Addons for Elementor <= 6.6.4 Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler PoC, Patch Analysis & Rule
Medium CVE-2026-7665 in Essential Addons For Elementor Lite (CVSS 5.3): Essential Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.6.5.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.