AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
June 11, 2026
CVE-2026-9197: Smart Slider 3 <= 3.5.1.36 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export PoC, Patch Analysis & Rule
Medium CVE-2026-9197 in Smart Slider 3 (CVSS 4.9): Smart Slider 3. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 11, 2026
CVE-2026-7565: LearnPress <= 4.1.4 Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7565 in Learnpress Import Export (CVSS 4.9): LearnPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.1.5.
June 11, 2026
CVE-2026-8502: LearnPress <= 4.3.6 Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-8502 in Learnpress (CVSS 5.3): LearnPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.7.
June 11, 2026
CVE-2026-8611: Klamra Paycal for Aspaclaria <= 1.1.4 Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-8611 in Klamra Paycal For Aspaclaria (CVSS 4.3): Klamra Paycal for Aspaclaria. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.5.
June 11, 2026
CVE-2026-7796: EmbedPress <= 4.5.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-7796 in Embedpress (CVSS 6.4): EmbedPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.5.4.
June 11, 2026
CVE-2026-7792: WPForms <= 1.10.0.4 Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-7792 in Wpforms Lite (CVSS 5.3): WPForms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.10.0.5.
June 11, 2026
CVE-2026-8991: Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings PoC, Patch Analysis & Rule
Medium CVE-2026-8991 in Drag And Drop Multiple File Upload Contact Form 7 (CVSS 4.4): Drag and Drop Multiple File Upload for Contact Form 7. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.9.8.
June 11, 2026
CVE-2026-7537: MDJM Event Management <= 1.7.8.3 Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter PoC, Patch Analysis & Rule
High CVE-2026-7537 in Mobile Dj Manager (CVSS 7.2): MDJM Event Management. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.8.4.
June 11, 2026
CVE-2026-7566: LearnPress – Backup & Migration Tool <= 4.1.4 Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload PoC, Patch Analysis & Rule
Medium CVE-2026-7566 in Learnpress Import Export (CVSS 6.6): LearnPress – Backup & Migration Tool. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.1.5.
June 11, 2026
CVE-2026-8978: OptinCraft <= 1.2.0 Authenticated (Administrator+) SQL Injection via 'order_by' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-8978 in Optincraft (CVSS 4.9): OptinCraft. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.1.
June 11, 2026
CVE-2026-9280: Ad Inserter <= 2.8.15 Reflected Cross-Site Scripting via URL Parameters in iframe Mode PoC, Patch Analysis & Rule
Medium CVE-2026-9280 in Ad Inserter (CVSS 6.1): Ad Inserter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.8.16.
June 11, 2026
CVE-2026-7795: Click to Chat <= 4.39 Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7795 in Click To Chat For Whatsapp (CVSS 6.4): Click to Chat. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.40.
June 11, 2026
CVE-2026-9008: Page-list <= 6.2 Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-9008 in Page List (CVSS 4.3): Page-list. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.3.
June 11, 2026
CVE-2026-9281: Master Addons For Elementor <= 3.1.0 Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) PoC, Patch Analysis & Rule
Medium CVE-2026-9281 in Master Addons (CVSS 6.4): Master Addons For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
June 11, 2026
CVE-2026-8901: Integration for Freshsales <= 1.0.15 Unauthenticated Stored Cross-Site Scripting via Form Submission Data PoC, Patch Analysis & Rule
High CVE-2026-8901 in Crm Integration Freshworks Any Form (CVSS 7.2): Integration for Freshsales. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.16.
June 10, 2026
CVE-2026-10795: UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 Unauthenticated Authentication Bypass via UpdraftCentral udrpc PoC, Patch Analysis & Rule
High CVE-2026-10795 in Updraftplus (CVSS 8.1): UpdraftPlus: WP Backup & Migration Plugin. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.26.5.
June 10, 2026
CVE-2026-2827: Open User Map PRO <= 1.4.31 Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification' PoC, Patch Analysis & Rule
Medium CVE-2026-2827 in Open User Map Pro (CVSS 4.7): Open User Map PRO. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 10, 2026
CVE-2026-8940: WP Meta Sort Posts <= 0.9 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-8940 in Wp Meta Sort Posts (CVSS 4.3): WP Meta Sort Posts. Atomic Edge summarizes impact, exploitability, and patch details.
June 10, 2026
CVE-2026-9185: 6Storage Rentals <= 2.22.0 Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter PoC, Patch Analysis & Rule
High CVE-2026-9185 in 6storage Rentals (CVSS 7.5): 6Storage Rentals. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
June 10, 2026
CVE-2026-8904: FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 Cross-Site Request Forgery via Settings Save PoC, Patch Analysis & Rule
Medium CVE-2026-8904 in Fastpicker (CVSS 4.3): FastPicker, an order picker and order management system (oms) for WooCommerce on steroids. Atomic Edge summarizes impact, exploitability, and patch details.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.