AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 4, 2026
CVE-2026-6457: Geo Mashup <= 1.13.19 Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6457 in Geo Mashup (CVSS 6.5): Geo Mashup. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.13.20.
May 4, 2026
CVE-2026-7049: PixelYourSite Pro <= 12.5.0.1 Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter PoC, Patch Analysis & Rule
High CVE-2026-7049 in Pixelyoursite Pro (CVSS 7.2): PixelYourSite Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-7641: Import and export users and customers <= 2.0.8 Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields PoC, Patch Analysis & Rule
High CVE-2026-7641 in Import Users From Csv With Meta (CVSS 8.8): Import and export users and customers. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.0.9.
May 4, 2026
CVE-2026-4882: User Registration Advanced Fields <= 1.6.20 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-4882 in User Registration Advanced Fields (CVSS 9.8): User Registration Advanced Fields. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-7638: App Builder <= 5.5.10 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7638 in App Builder (CVSS 5.3): App Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-7209: Simple Link Directory <= 8.9.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-7209 in Simple Link Directory (CVSS 6.4): Simple Link Directory. Atomic Edge summarizes impact, exploitability, and patch details. Update to 8.9.4.
May 4, 2026
CVE-2025-14726: Widgets for Social Photo Feed <= 1.8 Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints PoC, Patch Analysis & Rule
Medium CVE-2025-14726 in Social Photo Feed Widget (CVSS 6.5): Widgets for Social Photo Feed. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-7458: User Verification by PickPlugins <= 2.0.46 Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint PoC, Patch Analysis & Rule
Critical CVE-2026-7458 in User Verification (CVSS 9.8): User Verification by PickPlugins. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-4658: Gutenberg Essential Blocks <= 6.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-4658 in Essential Blocks (CVSS 6.4): Gutenberg Essential Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.1.0.
May 4, 2026
CVE-2026-6916: Jeg Kit for Elementor <= 3.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6916 in Jeg Elementor Kit (CVSS 6.4): Jeg Kit for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
May 4, 2026
CVE-2026-6378: Maxi Blocks <= 2.1.9 Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API PoC, Patch Analysis & Rule
Medium CVE-2026-6378 in Maxi Blocks (CVSS 6.4): Maxi Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.10.
May 4, 2026
CVE-2026-3504: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 Unauthenticated Information Disclosure in Store Reviews REST API Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-3504 in Dokan Lite (CVSS 5.3): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.3.2.
May 4, 2026
CVE-2026-5109: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Product Option PoC, Patch Analysis & Rule
High CVE-2026-5109 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-5112: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater PoC, Patch Analysis & Rule
High CVE-2026-5112 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-5063: NEX-Forms <= 9.1.11 Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names PoC, Patch Analysis & Rule
High CVE-2026-5063 in Nex Forms Express Wp Form Builder (CVSS 7.2): NEX-Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.1.12.
May 4, 2026
CVE-2026-5113: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input PoC, Patch Analysis & Rule
High CVE-2026-5113 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-5111: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater PoC, Patch Analysis & Rule
High CVE-2026-5111 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-0703: NextMove Lite Thank You Page for WooCommerce <= 2.23.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0703 in Woo Thank You Page Nextmove Lite (CVSS 6.4): NextMove Lite - Thank You Page for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.24.0.
May 4, 2026
CVE-2026-5110: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater PoC, Patch Analysis & Rule
High CVE-2026-5110 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-4100: Paid Memberships Pro <= 3.6.5 Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption PoC, Patch Analysis & Rule
High CVE-2026-4100 in Paid Memberships Pro (CVSS 7.1): Paid Memberships Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.