AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 21, 2026
CVE-2026-8684: MotoPress Hotel Booking <= 6.0.1 Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-8684 in Motopress Hotel Booking Lite (CVSS 5.3): MotoPress Hotel Booking. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.0.2.
May 21, 2026
CVE-2026-7636: Slider by Soliloquy <= 2.8.1 Authenticated (Subscriber+) Information Disclosure via REST API Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-7636 in Soliloquy Lite (CVSS 4.3): Slider by Soliloquy. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.8.2.
May 21, 2026
CVE-2026-3481: WP Blockade <= 0.9.14 Reflected Cross-Site Scripting via 'shortcode' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3481 in Wp Blockade (CVSS 6.1): WP Blockade. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-4070: Alfie <= 1.2.1 Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4070 in Alfie The Productfeedtool Wp Plugin (CVSS 4.3): Alfie. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-9011: Ditty <= 3.1.65 Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action PoC, Patch Analysis & Rule
High CVE-2026-9011 in Ditty News Ticker (CVSS 7.5): Ditty. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.66.
May 21, 2026
CVE-2026-9104: Draft List <= 2.6.3 Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title PoC, Patch Analysis & Rule
Medium CVE-2026-9104 in Simple Draft List (CVSS 6.4): Draft List. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.6.4.
May 21, 2026
CVE-2026-9018: Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 Unauthenticated Privilege Escalation via 'custom_meta' Parameter PoC, Patch Analysis & Rule
High CVE-2026-9018 in Easy Elements (CVSS 8.8): Easy Elements for Elementor – Addons & Website Templates. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 21, 2026
CVE-2026-7798: FluentCRM <= 2.9.87 Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7798 in Fluent Crm (CVSS 5.4): FluentCRM. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.0.
May 21, 2026
CVE-2026-7509: KIA Subtitle <= 4.0.1 [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] PoC, Patch Analysis & Rule
Medium CVE-2026-7509 in Kia Subtitle (CVSS 6.4): KIA Subtitle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.2.
May 21, 2026
CVE-2026-7249: Location Weather <= 3.0.2 Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging PoC, Patch Analysis & Rule
Medium CVE-2026-7249 in Location Weather (CVSS 4.3): Location Weather. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.0.3.
May 21, 2026
CVE-2026-6864: CBX 5 Star Rating & Review <= 1.0.7 Reflected Cross-Site Scripting via 'page' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6864 in Cbxscratingreview (CVSS 6.1): CBX 5 Star Rating & Review. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.8.
May 21, 2026
CVE-2026-4834: WP ERP Pro <= 1.5.1 Unauthenticated SQL Injection via 'search_key' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4834 in Erp Pro (CVSS 7.5): WP ERP Pro. Atomic Edge summarizes impact, exploitability, and patch details.
May 21, 2026
CVE-2026-6555: ProSolution WP Client <= 2.0.0 Unauthenticated Arbitrary File Upload via 'files' PoC, Patch Analysis & Rule
Critical CVE-2026-6555 in Prosolution Wp Client (CVSS 9.8): ProSolution WP Client. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.0.1.
May 21, 2026
CVE-2026-4843: GSheet For Woo Importer <= 2.3.1 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset PoC, Patch Analysis & Rule
Medium CVE-2026-4843 in Import Products From Gsheet For Woo Importer (CVSS 4.3): GSheet For Woo Importer. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.1.
May 21, 2026
CVE-2026-6960: BookingPress Pro <= 5.6 Unauthenticated Arbitrary File Upload via Signature Custom Field PoC, Patch Analysis & Rule
Critical CVE-2026-6960 in Bookingpress Appointment Booking Pro (CVSS 9.8): BookingPress Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 21, 2026
CVE-2026-6394: Nexa Blocks <= 1.1.1 Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6394 in Nexa Blocks (CVSS 5.4): Nexa Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 21, 2026
CVE-2026-6391: Sentence To SEO (keywords, description and tags) <= 1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-6391 in Sentence To Seo (CVSS 6.1): Sentence To SEO (keywords, description and tags). Atomic Edge summarizes impact, exploitability, and patch details.
May 20, 2026
CVE-2026-1543: Avada (Fusion) Builder <= 3.15.2 Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes PoC, Patch Analysis & Rule
Medium CVE-2026-1543 in Fusion Builder (CVSS 6.4): Avada (Fusion) Builder. Atomic Edge summarizes impact, exploitability, and patch details.
May 20, 2026
CVE-2026-1881: Broadstreet <= 1.52.2 Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta PoC, Patch Analysis & Rule
Medium CVE-2026-1881 in Broadstreet (CVSS 4.3): Broadstreet. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.53.2.
May 20, 2026
CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler PoC, Patch Analysis & Rule
Critical CVE-2026-6279 in Fusion Builder (CVSS 9.8): Avada (Fusion) Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.