AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-4896: WCFM WooCommerce Frontend Manager <= 6.7.25 Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation PoC, Patch Analysis & Rule
High CVE-2026-4896 in Wc Frontend Manager (CVSS 8.1): WCFM - WooCommerce Frontend Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.7.26.
April 6, 2026
CVE-2026-0664: Royal Elementor Addons <= 1.7.1049 Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass PoC, Patch Analysis & Rule
Medium CVE-2026-0664 in Royal Elementor Addons (CVSS 6.4): Royal Elementor Addons. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.1050.
April 6, 2026
CVE-2026-0737: Shortcodes Ultimate <= 7.4.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0737 in Shortcodes Ultimate (CVSS 6.4): Shortcodes Ultimate. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 7.4.8.
April 6, 2026
CVE-2025-13368: Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13368 in Xpro Elementor Addons (CVSS 6.4): Xpro Addons — 140+ Widgets for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-2924: Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' PoC, Patch Analysis & Rule
Medium CVE-2026-2924 in Gutenverse (CVSS 6.4): Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.4.7.
April 6, 2026
CVE-2026-2949: Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget PoC, Patch Analysis & Rule
Medium CVE-2026-2949 in Xpro Elementor Addons (CVSS 6.4): Xpro Addons — 140+ Widgets for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-3571: Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 Missing Authorization to Unauthenticated Registration Form Status Modification PoC, Patch Analysis & Rule
Medium CVE-2026-3571 in Pie Register (CVSS 6.5): Pie Register – User Registration, Profiles & Content Restriction. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.8.4.9.
April 6, 2026
CVE-2026-25328: Product File Upload for WooCommerce <= 2.2.4 Unauthenticated Arbitrary File Deletion PoC, Patch Analysis & Rule
High CVE-2026-25328 in Products File Upload For Woocommerce (CVSS 8.1): Product File Upload for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-25018: NaturaLife Extensions <= 2.1 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-25018 in Naturalife Extensions (CVSS 6.1): NaturaLife Extensions. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-25034: KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25034 in Kivicare Clinic Management System (CVSS 5.3): KiviCare – Clinic & Patient Management System (EHR). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.0.0.
April 6, 2026
CVE-2026-32573: Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 Authenticated (Editor+) Remote Code Execution PoC, Patch Analysis & Rule
High CVE-2026-32573 in Nelio Ab Testing (CVSS 7.2): Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 8.2.8.
April 6, 2026
CVE-2026-25406: Tutor LMS Pro <= 3.9.4 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25406 in Tutor Pro (CVSS 5.3): Tutor LMS Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-25017: NaturaLife Extensions <= 2.1 Unauthenticated Local File Inclusion PoC, Patch Analysis & Rule
High CVE-2026-25017 in Naturalife Extensions (CVSS 8.1): NaturaLife Extensions. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-32562: PPWP – Password Protect Pages <= 1.9.15 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-32562 in Password Protect Page (CVSS 4.3): PPWP – Password Protect Pages. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.9.16.
April 6, 2026
CVE-2026-25414: WPBookit Pro <= 1.6.18 Authenticated (Subscriber+) Privilege Escalation PoC, Patch Analysis & Rule
Medium CVE-2026-25414 in Wpbookit Pro (CVSS 4.3): WPBookit Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-23977: Helpdesk Support Ticket System for WooCommerce <= 2.1.2 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-23977 in Support Ticket System For Woocommerce (CVSS 5.3): Helpdesk Support Ticket System for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.3.
April 6, 2026
CVE-2026-24369: The Grid < 2.8.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-24369 in The Grid (CVSS 4.3): The Grid < 2.8.0 - Missing Authorization. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-32545: Taboola Pixel <= 1.1.4 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-32545 in Taboola Pixel (CVSS 6.1): Taboola Pixel. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.5.
April 6, 2026
CVE-2026-25397: File Uploader for WooCommerce <= 1.0.4 Unauthenticated Path Traversal PoC, Patch Analysis & Rule
Medium CVE-2026-25397 in File Uploader For Woocommerce (CVSS 5.3): File Uploader for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-25443: Fraud Prevention For WooCommerce and EDD <= 2.3.3 Missing Authorization to Unauthenticated Arbitrary Content Deletion PoC, Patch Analysis & Rule
High CVE-2026-25443 in Woo Blocker Lite Prevent Fake Orders And Blacklist Fraud Customers (CVSS 7.5): Fraud Prevention For WooCommerce and EDD. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.