AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 5, 2026
CVE-2026-6255: Simple Owl Shortcodes <= 2.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6255 in Simple Owl Shortcodes (CVSS 6.4): Simple Owl Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details.
May 5, 2026
CVE-2026-6344: Fluent Forms <= 6.2.1 Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment PoC, Patch Analysis & Rule
Medium CVE-2026-6344 in Fluentform (CVSS 4.9): Fluent Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.2.2.
May 5, 2026
CVE-2026-6700: DX Sources <= 2.0.1 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-6700 in Dx Sources (CVSS 4.3): DX Sources. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 5, 2026
CVE-2026-6701: addfreespace <= 0.1.3 Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page PoC, Patch Analysis & Rule
Medium CVE-2026-6701 in Addfreespace (CVSS 4.3): addfreespace. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 5, 2026
CVE-2026-5247: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-5247 in Post Expirator (CVSS 5.5): Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
May 5, 2026
CVE-2026-5505: WP-Clippy <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-5505 in Wp Clippy (CVSS 6.4): WP-Clippy. Atomic Edge summarizes impact, exploitability, and patch details.
May 5, 2026
CVE-2025-13618: Mentoring <= 1.2.8 Unauthenticated Privilege Escalation in mentoring_process_registration PoC, Patch Analysis & Rule
Critical CVE-2025-13618 in Mentoring (CVSS 9.8): Mentoring. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 5, 2026
CVE-2026-1921: Loco Translate <= 2.8.2 Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-1921 in Loco Translate (CVSS 4.9): Loco Translate. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.8.3.
May 5, 2026
CVE-2026-5722: MoreConvert Pro <= 1.9.14 Authentication Bypass via Waitlist Guest Verification Token Reuse PoC, Patch Analysis & Rule
Critical CVE-2026-5722 in Smart Wishlist For More Convert Premium (CVSS 9.8): MoreConvert Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 5, 2026
CVE-2026-42661: WP Customer Area <= 8.3.4 Authenticated (Custom+) Path Traversal PoC, Patch Analysis & Rule
Medium CVE-2026-42661 in Customer Area (CVSS 5.3): WP Customer Area. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.3.5.
May 5, 2026
CVE-2026-42662: Event Tickets and Registration <= 5.27.5 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-42662 in Event Tickets (CVSS 5.3): Event Tickets and Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.27.6.1.
May 4, 2026
CVE-2026-1396: Magic Conversation For Gravity Forms <= 3.0.97 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1396 in Magic Conversation For Gravity Forms (CVSS 6.4): Magic Conversation For Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-1865: User Registration & Membership <= 5.1.2 Authenticated (Subscriber+) SQL Injection via membership_ids[] PoC, Patch Analysis & Rule
Medium CVE-2026-1865 in User Registration (CVSS 6.5): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.3.
May 4, 2026
CVE-2026-6498: Five Star Restaurant Reservations <= 2.7.16 Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6498 in Restaurant Reservations (CVSS 5.3): Five Star Restaurant Reservations. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.7.17.
May 4, 2026
CVE-2026-4025: PrivateContent Free <= 1.2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4025 in Privatecontent Free (CVSS 6.4): PrivateContent Free. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.3.0.
May 4, 2026
CVE-2026-2892: Otter Blocks <= 3.1.4 Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie PoC, Patch Analysis & Rule
High CVE-2026-2892 in Otter Blocks (CVSS 7.5): Otter Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.5.
May 4, 2026
CVE-2026-4303: WP Visitor Statistics (Real Time Traffic) <= 8.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4303 in Wp Stats Manager (CVSS 6.4): WP Visitor Statistics (Real Time Traffic). Atomic Edge summarizes impact, exploitability, and patch details. Update to 8.5.
May 4, 2026
CVE-2026-4073: pdfl.io <= 1.0.5 Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4073 in Pdfl Io (CVSS 6.4): pdfl.io. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.0.6.
May 4, 2026
CVE-2026-4655: Element Pack Addons for Elementor <= 8.4.2 Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget PoC, Patch Analysis & Rule
Medium CVE-2026-4655 in Bdthemes Element Pack Lite (CVSS 6.4): Element Pack Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.5.0.
May 4, 2026
CVE-2026-2481: Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]' PoC, Patch Analysis & Rule
Medium CVE-2026-2481 in Beaver Builder Lite Version (CVSS 6.4): Beaver Builder Page Builder – Drag and Drop Website Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.