AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 17, 2026
CVE-2026-6451: CMS für Motorrad Werkstätten <= 1.0.0 Cross-Site Request Forgery PoC, Patch Analysis & Rule
Medium CVE-2026-6451 in Cms Fuer Motorrad Werkstaetten (CVSS 4.3): CMS für Motorrad Werkstätten. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 17, 2026
CVE-2026-6439: VideoZen <= 1.0.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field PoC, Patch Analysis & Rule
Medium CVE-2026-6439 in Videozen (CVSS 4.4): VideoZen. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 17, 2026
CVE-2026-5234: LatePoint <= 5.3.2 Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID PoC, Patch Analysis & Rule
Medium CVE-2026-5234 in Latepoint (CVSS 5.3): LatePoint. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.4.0.
April 17, 2026
CVE-2026-3488: WP Statistics <= 14.16.4 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation PoC, Patch Analysis & Rule
Medium CVE-2026-3488 in Wp Statistics (CVSS 6.5): WP Statistics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 14.16.5.
April 17, 2026
CVE-2026-4817: MasterStudy LMS <= 3.7.25 Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters PoC, Patch Analysis & Rule
Medium CVE-2026-4817 in Masterstudy Lms Learning Management System (CVSS 6.5): MasterStudy LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.7.26.
April 16, 2026
CVE-2025-49931: JetSearch <= 3.5.10 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-49931 in Jet Search (CVSS 7.5): JetSearch. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 10, 2026
CVE-2025-6986: FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 Authenticated (Author+) SQL Injection PoC, Patch Analysis & Rule
Medium CVE-2025-6986 in Filebird (CVSS 6.5): FileBird – WordPress Media Library Folders & File Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.4.9.
April 6, 2026
CVE-2026-0626: WPFunnels <= 3.7.9 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0626 in Wpfunnels (CVSS 6.4): WPFunnels. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-2936: Visitor Traffic Real Time Statistics <= 8.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2026-2936 in Visitors Traffic Real Time Statistics (CVSS 7.2): Visitor Traffic Real Time Statistics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.5.
April 6, 2026
CVE-2026-5425: Widgets for Social Photo Feed <= 1.7.9 Unauthenticated Stored Cross-Site Scripting via feed_data PoC, Patch Analysis & Rule
High CVE-2026-5425 in Social Photo Feed Widget (CVSS 7.2): Widgets for Social Photo Feed. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.8.
April 6, 2026
CVE-2026-3666: wpForo Forum <= 2.4.16 Authenticated (Subscriber+) Arbitrary File Deletion via Post Body PoC, Patch Analysis & Rule
High CVE-2026-3666 in Wpforo (CVSS 8.8): wpForo Forum. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.17.
April 6, 2026
CVE-2025-14938: Listeo-Core Directory Plugin by Purethemes <= 2.0.27 Unauthenticated Arbitrary Media Upload PoC, Patch Analysis & Rule
Medium CVE-2025-14938 in Listeo Core (CVSS 5.3): Listeo-Core - Directory Plugin by Purethemes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-3309: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields PoC, Patch Analysis & Rule
Medium CVE-2026-3309 in Wp User Avatar (CVSS 6.5): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
April 6, 2026
CVE-2026-2826: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 Missing Authorization to Authenticated (Contributor+) Media Upload PoC, Patch Analysis & Rule
Medium CVE-2026-2826 in Kadence Blocks (CVSS 4.3): Kadence Blocks — Page Builder Toolkit for Gutenberg Editor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.6.4.
April 6, 2026
CVE-2026-3445: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass PoC, Patch Analysis & Rule
High CVE-2026-3445 in Wp User Avatar (CVSS 7.1): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict.... Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
April 6, 2026
CVE-2026-0738: Shortcodes Ultimate <= 7.4.8 authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0738 in Shortcodes Ultimate (CVSS 6.4): Shortcodes Ultimate. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.4.9.
April 6, 2026
CVE-2026-2437: WP Travel Engine Travel and Tour Booking Plugin <= 6.7.5 Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-2437 in Wp Travel Engine (CVSS 6.4): WP Travel Engine - Travel and Tour Booking Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.7.6.
April 6, 2026
CVE-2026-0552: Simple Shopping Cart <= 5.2.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0552 in Wordpress Simple Paypal Shopping Cart (CVSS 6.4): Simple Shopping Cart. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.2.5.
April 6, 2026
CVE-2026-2600: ElementsKit Elementor Addons and Templates <= 3.7.9 Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget PoC, Patch Analysis & Rule
Medium CVE-2026-2600 in Elementskit Lite (CVSS 6.4): ElementsKit Elementor Addons and Templates. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.8.0.
April 6, 2026
CVE-2025-15064: Ultimate Member <= 2.11.1 Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets PoC, Patch Analysis & Rule
Medium CVE-2025-15064 in Ultimate Member (CVSS 6.4): Ultimate Member. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.11.2.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.