AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 13, 2026
CVE-2026-6145: User Registration & Membership <= 5.1.5 Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6145 in User Registration (CVSS 5.3): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.1.6.
May 13, 2026
CVE-2026-6252: Meta Field Block <= 1.5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6252 in Display A Meta Field As Block (CVSS 6.4): Meta Field Block. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.5.3.
May 13, 2026
CVE-2026-6225: Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6225 in Taskbuilder (CVSS 6.5): Taskbuilder – Project Management & Task Management Tool With Kanban Board. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.7.
May 13, 2026
CVE-2026-6670: Media Sync <= 1.4.9 Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-6670 in Media Sync (CVSS 6.5): Media Sync. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.0.
May 13, 2026
CVE-2026-6512: InfusedWoo Pro <= 5.1.2 Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters PoC, Patch Analysis & Rule
Critical CVE-2026-6512 in InfusedwooPRO (CVSS 9.1): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-5193: Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 Authenticated (Author+) Limited Privilege Escalation via register_user PoC, Patch Analysis & Rule
Medium CVE-2026-5193 in Essential Addons For Elementor Lite (CVSS 6.5): Essential Addons for Elementor – Popular Elementor Templates & Widgets. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.6.0.
May 13, 2026
CVE-2026-3694: Bold Page Builder <= 5.6.8 Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-3694 in Bold Page Builder (CVSS 6.4): Bold Page Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6510: InfusedWoo Pro <= 5.1.2 Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' PoC, Patch Analysis & Rule
Critical CVE-2026-6510 in InfusedwooPRO (CVSS 9.8): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6506: InfusedWoo Pro <= 5.1.2 Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update PoC, Patch Analysis & Rule
High CVE-2026-6506 in InfusedwooPRO (CVSS 8.8): InfusedWoo Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 13, 2026
CVE-2026-6174: CC Child Pages <= 2.1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6174 in Cc Child Pages (CVSS 6.4): CC Child Pages. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.1.2.
May 13, 2026
CVE-2026-3718: ManageWP Worker <= 4.9.31 Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header PoC, Patch Analysis & Rule
High CVE-2026-3718 in Worker (CVSS 7.2): ManageWP Worker. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.9.32.
May 13, 2026
CVE-2026-5395: Fluent Forms <= 6.2.0 Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5395 in Fluentform (CVSS 8.2): Fluent Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.2.1.
May 13, 2026
CVE-2026-5365: LatePoint <= 5.3.2 Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route PoC, Patch Analysis & Rule
Medium CVE-2026-5365 in Latepoint (CVSS 4.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.4.0.
May 13, 2026
CVE-2025-15345: MapGeo Interactive Geo Maps <= 1.6.27 Reflected Cross-Site Scripting via 'map' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-15345 in Interactive Geo Maps (CVSS 6.1): MapGeo - Interactive Geo Maps. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.28.
May 13, 2026
CVE-2026-6417: GLS Shipping for WooCommerce <= 1.4.0 Reflected Cross-Site Scripting via 'failed_orders' PoC, Patch Analysis & Rule
Medium CVE-2026-6417 in Gls Shipping For Woocommerce (CVSS 6.1): GLS Shipping for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.1.
May 13, 2026
CVE-2026-6271: Career Section <= 1.7 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2026-6271 in Career Section (CVSS 9.8): Career Section. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.8.
May 13, 2026
CVE-2026-3892: Motors – Car Dealer, Classifieds & Listing <= 1.4.107 Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter PoC, Patch Analysis & Rule
High CVE-2026-3892 in Motors Car Dealership Classified Listings (CVSS 8.1): Motors – Car Dealer, Classifieds & Listing. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.4.108.
May 12, 2026
CVE-2026-6965: Tutor LMS <= 3.9.9 Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6965 in Tutor (CVSS 5.3): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.9.10.
May 12, 2026
CVE-2026-4798: Avada Builder <= 3.15.1 Unauthenticated SQL Injection via 'product_order' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4798 in Fusion Builder (CVSS 7.5): Avada Builder. Atomic Edge summarizes impact, exploitability, and patch details.
May 12, 2026
CVE-2026-6929: JoomSport <= 5.7.7 Unauthenticated SQL Injection via 'sortf' Parameter PoC, Patch Analysis & Rule
High CVE-2026-6929 in Joomsport Sports League Results Management (CVSS 7.5): JoomSport. Atomic Edge summarizes impact, exploitability, and patch details.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.