AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
May 4, 2026
CVE-2026-7209: Simple Link Directory <= 8.9.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-7209 in Simple Link Directory (CVSS 6.4): Simple Link Directory. Atomic Edge summarizes impact, exploitability, and patch details. Update to 8.9.4.
May 4, 2026
CVE-2025-14726: Widgets for Social Photo Feed <= 1.8 Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints PoC, Patch Analysis & Rule
Medium CVE-2025-14726 in Social Photo Feed Widget (CVSS 6.5): Widgets for Social Photo Feed. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-7458: User Verification by PickPlugins <= 2.0.46 Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint PoC, Patch Analysis & Rule
Critical CVE-2026-7458 in User Verification (CVSS 9.8): User Verification by PickPlugins. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-4658: Gutenberg Essential Blocks <= 6.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-4658 in Essential Blocks (CVSS 6.4): Gutenberg Essential Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.1.0.
May 4, 2026
CVE-2026-6916: Jeg Kit for Elementor <= 3.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-6916 in Jeg Elementor Kit (CVSS 6.4): Jeg Kit for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.1.
May 4, 2026
CVE-2026-6378: Maxi Blocks <= 2.1.9 Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API PoC, Patch Analysis & Rule
Medium CVE-2026-6378 in Maxi Blocks (CVSS 6.4): Maxi Blocks. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.10.
May 4, 2026
CVE-2026-3504: Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 Unauthenticated Information Disclosure in Store Reviews REST API Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-3504 in Dokan Lite (CVSS 5.3): Dokan: AI Powered WooCommerce Multivendor Marketplace Solution. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.3.2.
May 4, 2026
CVE-2026-5109: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Product Option PoC, Patch Analysis & Rule
High CVE-2026-5109 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-5112: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater PoC, Patch Analysis & Rule
High CVE-2026-5112 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-5063: NEX-Forms <= 9.1.11 Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names PoC, Patch Analysis & Rule
High CVE-2026-5063 in Nex Forms Express Wp Form Builder (CVSS 7.2): NEX-Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 9.1.12.
May 4, 2026
CVE-2026-5113: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input PoC, Patch Analysis & Rule
High CVE-2026-5113 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-5111: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater PoC, Patch Analysis & Rule
High CVE-2026-5111 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-0703: NextMove Lite Thank You Page for WooCommerce <= 2.23.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0703 in Woo Thank You Page Nextmove Lite (CVSS 6.4): NextMove Lite - Thank You Page for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.24.0.
May 4, 2026
CVE-2026-5110: Gravity Forms <= 2.10.0 Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater PoC, Patch Analysis & Rule
High CVE-2026-5110 in Gravityforms (CVSS 7.2): Gravity Forms. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-4100: Paid Memberships Pro <= 3.6.5 Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption PoC, Patch Analysis & Rule
High CVE-2026-4100 in Paid Memberships Pro (CVSS 7.1): Paid Memberships Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
May 4, 2026
CVE-2026-6229: Royal Addons for Elementor <= 1.7.1057 Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter PoC, Patch Analysis & Rule
High CVE-2026-6229 in Royal Elementor Addons (CVSS 7.2): Royal Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.1058.
May 4, 2026
CVE-2026-4060: Geo Mashup <= 1.13.18 Unauthenticated Time-Based SQL Injection via 'sort' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4060 in Geo Mashup (CVSS 7.5): Geo Mashup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.13.19.
May 4, 2026
CVE-2026-2052: Widget Options <= 4.2.2 Authenticated (Contributor+) Remote Code Execution via Display Logic PoC, Patch Analysis & Rule
High CVE-2026-2052 in Extended Widget Options (CVSS 8.8): Widget Options. Atomic Edge summarizes impact, exploitability, and patch details.
May 4, 2026
CVE-2026-2554: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion PoC, Patch Analysis & Rule
High CVE-2026-2554 in Wc Frontend Manager (CVSS 8.1): WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.7.26.
May 4, 2026
CVE-2026-4061: Geo Mashup <= 1.13.18 Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter PoC, Patch Analysis & Rule
High CVE-2026-4061 in Geo Mashup (CVSS 7.5): Geo Mashup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.13.19.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.