AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 26, 2026
CVE-2026-40725: WooCommerce Product Filters < 2.0.6 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-40725 in Woocommerce Product Filters (CVSS 8.1): WooCommerce Product Filters < 2.0.6 - Unauthenticated PHP Object Injection. Atomic Edge summarizes impact, exploitability, and patch details.
April 26, 2026
CVE-2025-15636: Video Gallery – YouTube Gallery & Responsive Video Playlist <= 3.5.1 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-15636 in Youtube Showcase (CVSS 6.4): Video Gallery – YouTube Gallery & Responsive Video Playlist. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.5.2.
April 26, 2026
CVE-2026-6372: Accept Cryptocurrencies with Plisio <= 2.0.6 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-6372 in Plisio Payment Gateway For Woocommerce (CVSS 5.3): Accept Cryptocurrencies with Plisio. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2025-63029: WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.1 Authenticated (Store vendor+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2025-63029 in Wc Multivendor Marketplace (CVSS 6.5): WCFM Marketplace – Multivendor Marketplace for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.7.2.
April 26, 2026
CVE-2026-40784: FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 1.91.2 Authenticated (Board Member+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
Medium CVE-2026-40784 in Fluent Boards (CVSS 4.3): FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team.... Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.91.3.
April 26, 2026
CVE-2026-3830: Product Filter for WooCommerce by WBW < 3.1.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-3830 in Woo Product Filter (CVSS 7.5): Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQL Injection. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.3.
April 26, 2026
CVE-2026-39531: WP Directory Kit <= 1.5.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39531 in Wpdirectorykit (CVSS 7.5): WP Directory Kit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.1.
April 26, 2026
CVE-2026-6370: Mini Ajax Cart for WooCommerce <= 1.3.4 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-6370 in Mini Ajax Woo Cart (CVSS 6.4): Mini Ajax Cart for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2025-15441: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-15441 in Form Maker (CVSS 7.5): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated.... Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.15.38.
April 26, 2026
CVE-2026-39511: WP Photo Album Plus <= 9.1.08.001 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39511 in Wp Photo Album Plus (CVSS 7.5): WP Photo Album Plus. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2026-39468: Meta Box <= 5.11.1 Authenticated (Contributor+) Arbitrary File Deletion PoC, Patch Analysis & Rule
High CVE-2026-39468 in Meta Box (CVSS 8.1): Meta Box. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.11.2.
April 26, 2026
CVE-2026-39525: Booking Activities <= 1.16.48.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-39525 in Booking Activities (CVSS 5.3): Booking Activities. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.17.0.
April 26, 2026
CVE-2026-39494: Product Filter for WooCommerce by WBW <= 3.1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39494 in Woo Product Filter (CVSS 7.5): Product Filter for WooCommerce by WBW. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.1.3.
April 26, 2026
CVE-2026-39491: Jupiter X Core <= 4.14.1 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-39491 in Jupiterx Core (CVSS 6.4): Jupiter X Core. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2026-39474: Post Duplicator <= 3.0.10 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-39474 in Post Duplicator (CVSS 7.5): Post Duplicator. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.0.11.
April 26, 2026
CVE-2024-49242: Digital Lottery <= 3.0.5 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2024-49242 in Digital Lottery (CVSS 9.8): Digital Lottery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 25, 2026
CVE-2026-5721: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import PoC, Patch Analysis & Rule
Medium CVE-2026-5721 in Wpdatatables (CVSS 4.7): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.5.0.5.
April 25, 2026
CVE-2024-31115: Chauffeur Taxi Booking System for WordPress <= 7.2 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2024-31115 in Chauffeur Booking System (CVSS 10.0): Chauffeur Taxi Booking System for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 25, 2026
CVE-2024-32692: Chauffeur Taxi Booking System for WordPress <= 6.9 Authentication Bypass PoC, Patch Analysis & Rule
Critical CVE-2024-32692 in Chauffeur Booking System (CVSS 9.1): Chauffeur Taxi Booking System for WordPress. Atomic Edge summarizes impact, exploitability, and patch details.
April 25, 2026
CVE-2025-1564: SetSail Membership <= 1.0.3 Authentication Bypass via Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2025-1564 in Setsail Membership (CVSS 9.8): SetSail Membership. Atomic Edge summarizes impact, exploitability, and patch details.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.