AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 14, 2026
CVE-2026-7563: Classified Listing <= 5.3.10 Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions PoC, Patch Analysis & Rule
Medium CVE-2026-7563 in Classified Listing (CVSS 4.3): Classified Listing. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.0.
May 14, 2026
CVE-2026-8425: Notify Odoo <= 1.0.1 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-8425 in Notify Odoo (CVSS 4.3): Notify Odoo. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-5229: Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 Unauthenticated Authentication Bypass via LINE OAuth Callback PoC, Patch Analysis & Rule
Critical CVE-2026-5229 in Form Notify (CVSS 9.8): Receive Notifications After Form Submitting – Form Notify for Any Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.11.
May 14, 2026
CVE-2026-4094: FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 Missing Authorization to Authenticated (Contributor+) Configuration Deletion PoC, Patch Analysis & Rule
High CVE-2026-4094 in Woocommerce Currency Switcher (CVSS 8.1): FOX – Currency Switcher Professional for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-4683: Smartcat Translator for WPML <= 3.1.77 Missing Authorization to Unauthenticated Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-4683 in Smartcat Wpml (CVSS 6.5): Smartcat Translator for WPML. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.78.
May 14, 2026
CVE-2026-6415: Advanced Custom Fields: Font Awesome Field <= 5.0.2 Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field PoC, Patch Analysis & Rule
Medium CVE-2026-6415 in Advanced Custom Fields Font Awesome (CVSS 6.4): Advanced Custom Fields: Font Awesome Field. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.0.0.
May 14, 2026
CVE-2026-5396: Fluent Forms <= 6.1.21 Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5396 in Fluentform (CVSS 8.2): Fluent Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.2.0.
May 14, 2026
CVE-2026-8181: Burst Statistics 3.4.0 3.4.1.1 Authentication Bypass to Admin Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2026-8181 in Burst Statistics (CVSS 9.8): Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.4.2.
May 14, 2026
CVE-2026-5361: Envira Gallery <= 1.12.4 Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5361 in Envira Gallery Lite (CVSS 6.4): Envira Gallery. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.12.5.
May 14, 2026
CVE-2026-42668: Omnisend for WooCommerce <= 1.18.0 Unauthenticated Omnisend Account Takeover via Predictable Connect Token PoC, Patch Analysis & Rule
High CVE-2026-42668 in Omnisend Connect (CVSS 7.5): Omnisend for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.18.1.
May 14, 2026
CVE-2026-5486: Unlimited Elements For Elementor <= 2.0.7 Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-5486 in Unlimited Elements For Elementor (CVSS 6.5): Unlimited Elements For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 14, 2026
CVE-2026-5243: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Lite Widget PoC, Patch Analysis & Rule
Medium CVE-2026-5243 in The Plus Addons For Elementor Page Builder (CVSS 6.4): The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce. Atomic Edge summarizes impact, exploitability, and...
May 14, 2026
CVE-2026-4031: Database Backup for WordPress <= 2.5.2 Missing Authorization to Unauthenticated Database Backup Interception PoC, Patch Analysis & Rule
High CVE-2026-4031 in Wp Db Backup (CVSS 7.5): Database Backup for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.3.
May 14, 2026
CVE-2026-3829: WP Encryption One Click SSL & Force HTTPS <= 7.8.5.10 Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering PoC, Patch Analysis & Rule
Medium CVE-2026-3829 in Wp Letsencrypt Ssl (CVSS 5.4): WP Encryption - One Click SSL & Force HTTPS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.8.5.11.
May 14, 2026
CVE-2026-7525: My Calendar <= 3.7.9 Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7525 in My Calendar (CVSS 4.3): My Calendar. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.7.10.
May 14, 2026
CVE-2026-7648: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-7648 in Learnpress (CVSS 4.3): LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.3.6.
May 14, 2026
CVE-2026-4030: Database Backup for WordPress <= 2.5.2 Missing Authorization to Unauthenticated Arbitrary File Read and Deletion PoC, Patch Analysis & Rule
High CVE-2026-4030 in Wp Db Backup (CVSS 8.1): Database Backup for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.5.3.
May 13, 2026
CVE-2026-6504: Royal Addons for Elementor <= 1.7.1058 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6504 in Royal Elementor Addons (CVSS 6.4): Royal Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.7.1059.
May 13, 2026
CVE-2026-6206: MW WP Form <= 5.1.2 Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6206 in Mw Wp Form (CVSS 5.3): MW WP Form. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.3.
May 13, 2026
CVE-2026-6514: InfusedWoo Pro <= 5.1.2 Unauthenticated Arbitrary File Read via 'url' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6514 in InfusedwooPRO (CVSS 7.5): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.