AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 23, 2026
CVE-2026-2951: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML PoC, Patch Analysis & Rule
Medium CVE-2026-2951 in Gutentor (CVSS 5.4): Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.5.6.
April 23, 2026
CVE-2026-1379: HTTP Headers <= 1.19.2 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Custom Headers' Plugin Setting PoC, Patch Analysis & Rule
Medium CVE-2026-1379 in Http Headers (CVSS 4.4): HTTP Headers. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-4132: HTTP Headers <= 1.19.2 Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters PoC, Patch Analysis & Rule
High CVE-2026-4132 in Http Headers (CVSS 7.2): HTTP Headers. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-2717: HTTP Headers <= 1.19.2 Authenticated (Administrator+) CRLF Injection via Custom Header Values PoC, Patch Analysis & Rule
Medium CVE-2026-2717 in Http Headers (CVSS 5.5): HTTP Headers. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-4119: Create DB Tables <= 1.2.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php PoC, Patch Analysis & Rule
Critical CVE-2026-4119 in Create Db Tables (CVSS 9.1): Create DB Tables. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-4126: Table Manager <= 1.0.0 Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4126 in Table Manager (CVSS 4.3): Table Manager. Atomic Edge summarizes impact, exploitability, and patch details.
April 23, 2026
CVE-2026-4117: CalJ <= 1.5 Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action PoC, Patch Analysis & Rule
Medium CVE-2026-4117 in Calj (CVSS 5.3): CalJ. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-4131: WP Responsive Popup + Optin <= 1.4 Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4131 in Wp Popup Optin (CVSS 6.1): WP Responsive Popup + Optin. Atomic Edge summarizes impact, exploitability, and patch details.
April 23, 2026
CVE-2026-4128: TP Restore Categories And Taxonomies <= 1.0.1 Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-4128 in Tp Restore Categories And Taxonomies (CVSS 4.3): TP Restore Categories And Taxonomies. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 23, 2026
CVE-2026-4090: Inquiry cart <= 3.4.2 Cross-Site Request Forgery via Settings Form PoC, Patch Analysis & Rule
Medium CVE-2026-4090 in Inquiry Cart (CVSS 6.1): Inquiry cart. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 21, 2026
CVE-2025-12826: Custom Post Type UI <= 1.18.0 Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification PoC, Patch Analysis & Rule
Medium CVE-2025-12826 in Custom Post Type Ui (CVSS 4.8): Custom Post Type UI. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.18.1.
April 21, 2026
CVE-2026-2988: Blubrry PowerPress <= 11.15.15 Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes PoC, Patch Analysis & Rule
Medium CVE-2026-2988 in Powerpress (CVSS 6.4): Blubrry PowerPress. Atomic Edge summarizes impact, exploitability, and patch details. Update to 11.15.16.
April 21, 2026
CVE-2026-3499: Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 13.5.2.1 Cross-Site Request Forgery to Multiple Administrative Actions PoC, Patch Analysis & Rule
High CVE-2026-3499 in Woo Product Feed Pro (CVSS 8.8): Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 -.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF...
April 21, 2026
CVE-2026-3296: Everest Forms <= 3.4.3 Unauthenticated PHP Object Injection via Form Entry Metadata PoC, Patch Analysis & Rule
Critical CVE-2026-3296 in Everest Forms (CVSS 9.8): Everest Forms. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.4.4.
April 20, 2026
CVE-2025-14732: Elementor Website Builder <= 3.35.5 Authenticated (Contributor+) Stored Cross-Site Scripting via REST API PoC, Patch Analysis & Rule
Medium CVE-2025-14732 in Elementor (CVSS 6.4): Elementor Website Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.35.6.
April 20, 2026
CVE-2026-4401: Download Monitor <= 5.1.10 Cross-Site Request Forgery to Download Path Deletion and Disabling PoC, Patch Analysis & Rule
Medium CVE-2026-4401 in Download Monitor (CVSS 5.4): Download Monitor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.11.
April 20, 2026
CVE-2026-4394: Gravity Forms <= 2.9.30 Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field PoC, Patch Analysis & Rule
Medium CVE-2026-4394 in Gravityforms (CVSS 6.1): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 20, 2026
CVE-2026-4065: Smart Slider 3 <= 3.5.1.33 Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-4065 in Smart Slider 3 (CVSS 5.4): Smart Slider 3. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 20, 2026
CVE-2026-2263: Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-2263 in Wordpress Popup (CVSS 5.3): Hustle – Email Marketing, Lead Generation, Optins, Popups. Atomic Edge summarizes impact, exploitability, and patch details. Update to 7.8.11.
April 19, 2026
CVE-2026-2942: ProSolution WP Client <= 1.9.9 Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess PoC, Patch Analysis & Rule
Critical CVE-2026-2942 in Prosolution Wp Client (CVSS 9.8): ProSolution WP Client. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.0.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.