AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 17, 2026
CVE-2026-4979: UsersWP <= 1.2.58 Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4979 in Userswp (CVSS 5.0): UsersWP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.59.
April 17, 2026
CVE-2026-5144: BuddyPress Groupblog <= 1.9.3 Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR PoC, Patch Analysis & Rule
High CVE-2026-5144 in Bp Groupblog (CVSS 8.8): BuddyPress Groupblog. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.9.4.
April 17, 2026
CVE-2026-3498: BlockArt Blocks <= 2.2.15 Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3498 in Blockart Blocks (CVSS 6.4): BlockArt Blocks. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.3.0.
April 17, 2026
CVE-2026-4895: Greenshift <= 12.8.9 Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4895 in Greenshift Animation And Page Builder Blocks (CVSS 6.4): Greenshift. Atomic Edge summarizes impact, exploitability, and patch details. Update to 12.9.0.
April 17, 2026
CVE-2026-3358: Tutor LMS <= 3.9.7 Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment PoC, Patch Analysis & Rule
Medium CVE-2026-3358 in Tutor (CVSS 5.4): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.8.
April 17, 2026
CVE-2026-6203: User Registration & Membership <= 5.1.4 Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6203 in User Registration (CVSS 6.1): User Registration & Membership. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.1.5.
April 17, 2026
CVE-2026-5217: Optimole <= 4.2.2 Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter PoC, Patch Analysis & Rule
High CVE-2026-5217 in Optimole Wp (CVSS 7.2): Optimole. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.2.3.
April 17, 2026
CVE-2026-5809: wpForo Forum <= 3.0.2 Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5809 in Wpforo (CVSS 7.1): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.3.
April 17, 2026
CVE-2024-12118: The Events Calendar <= 6.9.0 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2024-12118 in The Events Calendar (CVSS 6.4): The Events Calendar. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.9.1.
April 17, 2026
CVE-2026-5427: Kubio AI Page Builder <= 2.7.2 Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-5427 in Kubio (CVSS 5.3): Kubio AI Page Builder. Atomic Edge summarizes impact, exploitability, and patch details. Update to 2.7.3.
April 17, 2026
CVE-2026-4853: JetBackup <= 3.1.19.8 Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4853 in Backup (CVSS 4.9): JetBackup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.20.3.
April 17, 2026
CVE-2026-4666: wpForo Forum <= 2.4.16 Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4666 in Wpforo (CVSS 6.5): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.0.
April 17, 2026
CVE-2026-3330: Form Maker by 10Web <= 1.15.40 Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3330 in Form Maker (CVSS 4.9): Form Maker by 10Web. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.15.41.
April 17, 2026
CVE-2026-4659: Unlimited Elements For Elementor <= 2.0.6 Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal PoC, Patch Analysis & Rule
High CVE-2026-4659 in Unlimited Elements For Elementor (CVSS 7.5): Unlimited Elements For Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 17, 2026
CVE-2026-5502: Tutor LMS <= 3.9.8 Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order PoC, Patch Analysis & Rule
Medium CVE-2026-5502 in Tutor (CVSS 5.3): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.9.9.
April 17, 2026
CVE-2026-5797: Quiz and Survey Master (QSM) <= 11.1.0 Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields PoC, Patch Analysis & Rule
Medium CVE-2026-5797 in Quiz Master Next (CVSS 5.3): Quiz and Survey Master (QSM). Atomic Edge summarizes impact, exploitability, and patch details. Update to 11.1.1.
April 17, 2026
CVE-2026-6080: Tutor LMS <= 3.9.8 Authenticated (Admin+) SQL Injection via 'date' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-6080 in Tutor (CVSS 6.5): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.9.
April 17, 2026
CVE-2026-5231: WP Statistics <= 14.16.4 Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter PoC, Patch Analysis & Rule
High CVE-2026-5231 in Wp Statistics (CVSS 7.2): WP Statistics. Atomic Edge summarizes impact, exploitability, and patch details. Update to 14.16.5.
April 17, 2026
CVE-2026-5162: Royal Addons for Elementor <= 1.7.1056 Authenticated (Contributor+) Stored Cross-Site Scripting via Instagram Feed Widget PoC, Patch Analysis & Rule
Medium CVE-2026-5162 in Royal Elementor Addons (CVSS 6.4): Royal Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.7.1057.
April 17, 2026
CVE-2026-4352: JetEngine <= 3.8.6.1 Unauthenticated SQL Injection via '_cct_search' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4352 in Jet Engine (CVSS 7.5): JetEngine. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.