AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 6, 2026
CVE-2026-32484: weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.26 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-32484 in Weforms (CVSS 8.1): weForms – Easy Drag & Drop Contact Form Builder For WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.6.27.
April 6, 2026
CVE-2026-25026: Team – Team Members Showcase Plugin <= 5.0.11 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25026 in Tlp Team (CVSS 5.3): Team – Team Members Showcase Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.0.12.
April 6, 2026
CVE-2026-25327: Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25327 in Restaurant Reservations (CVSS 5.3): Five Star Restaurant Reservations – WordPress Booking Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.7.10.
April 6, 2026
CVE-2026-32485: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-32485 in Wp User Frontend (CVSS 5.3): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule...
April 6, 2026
CVE-2026-25334: Salon Booking System Pro < 10.30.12 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-25334 in Salon Booking Plugin Pro (CVSS 5.3): Salon Booking System Pro < 10.30.12 - Missing Authorization. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 6, 2026
CVE-2026-32533: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
Medium CVE-2026-32533 in Latepoint (CVSS 4.3): LatePoint – Calendar Booking Plugin for Appointments and Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 5.2.7.
April 6, 2026
CVE-2026-1233: Text to Speech (TTS) by Mementor <= 1.9.8 Use of Hardcoded Password to Unauthenticated Remote Database Access PoC, Patch Analysis & Rule
High CVE-2026-1233 in Text To Speech Tts (CVSS 7.5): Text to Speech (TTS) by Mementor. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.9.9.
April 1, 2026
CVE-2025-13535: King Addons for Elementor <= 51.1.38 Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets PoC, Patch Analysis & Rule
Medium CVE-2025-13535 in King Addons (CVSS 6.4): King Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 51.1.54.
April 1, 2026
CVE-2026-3191: Minify HTML <= 2.1.12 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-3191 in Minify Html Markup (CVSS 5.4): Minify HTML. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.13.
April 1, 2026
CVE-2026-4267: Query Monitor <= 3.20.3 Reflected Cross-Site Scripting via Request URI PoC, Patch Analysis & Rule
High CVE-2026-4267 in Query Monitor (CVSS 7.2): Query Monitor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.20.4.
April 1, 2026
CVE-2026-1877: Auto Post Scheduler <= 1.84 Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page PoC, Patch Analysis & Rule
Medium CVE-2026-1877 in Auto Post Scheduler (CVSS 6.1): Auto Post Scheduler. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 1, 2026
CVE-2026-1797: Truebooker Appointment Booking and Scheduler Plugin <= 1.1.4 Sensitive Information Exposure via Views Files PoC, Patch Analysis & Rule
Medium CVE-2026-1797 in Truebooker Appointment Booking (CVSS 5.3): Truebooker - Appointment Booking and Scheduler Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.5.
April 1, 2026
CVE-2026-3831: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-3831 in Contact Form Entries (CVSS 4.3): Database for Contact Form 7, WPforms, Elementor forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.0.
April 1, 2026
CVE-2026-1834: Ibtana WordPress Website Builder <= 1.2.5.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-1834 in Ibtana Visual Editor (CVSS 6.4): Ibtana - WordPress Website Builder. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.5.8.
April 1, 2026
CVE-2026-4668: Amelia <= 2.1.2 Authenticated (Manager+) SQL Injection via 'sort' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4668 in Ameliabooking (CVSS 6.5): Amelia. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.3.
April 1, 2026
CVE-2026-3139: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field PoC, Patch Analysis & Rule
Medium CVE-2026-3139 in Profile Builder (CVSS 4.3): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
April 1, 2026
CVE-2026-2480: WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-2480 in Shortcodes Ultimate (CVSS 6.4): WP Shortcodes Plugin — Shortcodes Ultimate. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 1, 2026
CVE-2026-1710: WooPayments <= 10.5.1 Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax PoC, Patch Analysis & Rule
Medium CVE-2026-1710 in Woocommerce Payments (CVSS 6.5): WooPayments. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 10.6.0.
April 1, 2026
CVE-2026-4020: Gravity SMTP <= 2.1.4 Unauthenticated Sensitive Information Exposure via REST API PoC, Patch Analysis & Rule
High CVE-2026-4020 in Gravitysmtp (CVSS 7.5): Gravity SMTP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 1, 2026
CVE-2026-4146: Loco Translate <= 2.8.2 Reflected Cross-Site Scripting via 'update_href' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4146 in Loco Translate (CVSS 6.1): Loco Translate. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.8.3.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.