AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
July 20, 2026
CVE-2026-57350: WP Debugging <= 2.12.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-57350 affects the WP Debugging plugin (up to 2.12.2) with a high severity CVSS score of 7.2 due to stored XSS. Update to version 2.12.3 to mitigate risks from unauthenticated script injections.
July 20, 2026
CVE-2026-57349: WPeMatico RSS Feed Fetcher <= 2.8.17 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
CVE-2026-57349 affects the WPeMatico plugin (up to version 2.8.17) with a CVSS score of 7.2. This high-severity XSS vulnerability allows unauthenticated attackers to inject scripts. Update to version 2.8.18 to mitigate risks.
July 7, 2026
CVE-2026-12002: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12002 in Instagram Feed (CVSS 4.7): Smash Balloon Social Photo Feed – Easy Social Feeds Plugin. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.11.2.
July 7, 2026
CVE-2026-6740: Nexter Blocks <= 4.7.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6740 in The Plus Addons For Block Editor (CVSS 6.4): Nexter Blocks. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.7.5.
July 7, 2026
CVE-2026-5459: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite PoC, Patch Analysis & Rule
Medium CVE-2026-5459 in Wp User Frontend (CVSS 5.3): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
July 7, 2026
CVE-2026-6820: VikBooking Hotel Booking Engine & PMS <= 1.8.8 Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field PoC, Patch Analysis & Rule
High CVE-2026-6820 in Vikbooking (CVSS 7.2): VikBooking Hotel Booking Engine & PMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.9.
July 7, 2026
CVE-2026-6459: Essential Addons for Elementor <= 6.6.2 Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup PoC, Patch Analysis & Rule
Medium CVE-2026-6459 in Essential Addons For Elementor Lite (CVSS 6.4): Essential Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.6.3.
July 7, 2026
CVE-2026-6818: VikBooking Hotel Booking Engine & PMS <= 1.8.8 Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6818 in Vikbooking (CVSS 7.2): VikBooking Hotel Booking Engine & PMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.8.9.
July 7, 2026
CVE-2025-14785: Website Builder by SeedProd Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2025-14785 in Coming Soon (CVSS 6.4): Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.20.3.
July 7, 2026
CVE-2026-3688: WCFM WooCommerce Multivendor Membership <= 2.11.10 Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite PoC, Patch Analysis & Rule
High CVE-2026-3688 in Wc Multivendor Membership (CVSS 8.1): WCFM - WooCommerce Multivendor Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.11.11.
July 7, 2026
CVE-2026-6742: Advanced iFrame <= 2026.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6742 in Advanced Iframe (CVSS 6.4): Advanced iFrame. Atomic Edge summarizes impact, exploitability, and patch details.
July 7, 2026
CVE-2026-5356: LatePoint Calendar Booking Plugin for Appointments and Events <= 5.4.0 Unauthenticated Stripe PaymentIntent Amount-Binding Bypass PoC, Patch Analysis & Rule
High CVE-2026-5356 in Latepoint (CVSS 7.5): LatePoint - Calendar Booking Plugin for Appointments and Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.1.
July 7, 2026
CVE-2026-6854: My Calendar <= 3.7.8 Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters PoC, Patch Analysis & Rule
High CVE-2026-6854 in My Calendar (CVSS 7.5): My Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-6230: Tainacan <= 1.0.3 Unauthenticated SQL Injection via 'geoquery' REST API Parameter PoC, Patch Analysis & Rule
High CVE-2026-6230 in Tainacan (CVSS 7.5): Tainacan. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.0.
July 7, 2026
CVE-2026-11798: Social Share, Social Login and Social Comments Plugin <= 7.14.5 Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-11798 in Super Socializer (CVSS 6.1): Social Share, Social Login and Social Comments Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-14250: Themehunk Login Registration <= 1.0.2 Unauthenticated Privilege Escalation via 'role' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-14250 in Themehunk Login Registration (CVSS 6.3): Themehunk Login Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.3.
July 7, 2026
CVE-2026-14489: WHMCS Bridge <= 6.9 Unauthenticated Arbitrary File Upload via 'ccce' Parameter PoC, Patch Analysis & Rule
High CVE-2026-14489 in Whmcs Bridge (CVSS 8.8): WHMCS Bridge. Atomic Edge summarizes impact, exploitability, and patch details.
July 7, 2026
CVE-2026-12936: Recurio <= 1.1.3 Authenticated (Shop Manager+) SQL Injection via 'data' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-12936 in Recurio (CVSS 4.9): Recurio. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.1.4.
July 7, 2026
CVE-2026-12153: WP Learn Manager <= 1.1.8 Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action PoC, Patch Analysis & Rule
Critical CVE-2026-12153 in Learn Manager (CVSS 9.8): WP Learn Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
July 7, 2026
CVE-2026-12097: User Management <= 1.2 Missing Authorization to Unauthenticated Plugin Settings Modification PoC, Patch Analysis & Rule
Medium CVE-2026-12097 in User Management (CVSS 5.3): User Management. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.