AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 29, 2026
CVE-2026-3368: Injection Guard <= 1.2.9 Unauthenticated Stored Cross-Site Scripting via Query Parameter Name PoC, Patch Analysis & Rule
High CVE-2026-3368 in Injection Guard (CVSS 7.2): Injection Guard. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.3.0.
March 29, 2026
CVE-2026-3516: Contact List <= 3.0.18 Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3516 in Contact List (CVSS 6.4): Contact List. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.19.
March 29, 2026
CVE-2026-4083: Scoreboard for HTML5 Games Lite <= 1.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-4083 in Scoreboard For Html5 Game Lite (CVSS 6.4): Scoreboard for HTML5 Games Lite. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 29, 2026
CVE-2026-3584: Kali Forms <= 2.4.9 Unauthenticated Remote Code Execution via form_process PoC, Patch Analysis & Rule
Critical CVE-2026-3584 in Kali Forms (CVSS 9.8): Kali Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.10.
March 29, 2026
CVE-2026-4261: Expire Users <= 1.2.2 Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields PoC, Patch Analysis & Rule
High CVE-2026-4261 in Expire Users (CVSS 8.8): Expire Users. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 29, 2026
CVE-2026-3350: Image Alt Text Manager <= 1.8.2 Authenticated (Author+) Stored Cross-Site Scripting via Post Title PoC, Patch Analysis & Rule
Medium CVE-2026-3350 in Alt Manager (CVSS 6.4): Image Alt Text Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.8.3.
March 29, 2026
CVE-2026-32524: Photo Engine (Media Organizer & Lightroom) <= 6.4.9 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2026-32524 in Wplr Sync (CVSS 8.8): Photo Engine (Media Organizer & Lightroom). Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.5.0.
March 28, 2026
CVE-2026-3546: e-shot <= 1.0.2 Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-3546 in E Shot Form Builder (CVSS 5.3): e-shot. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3478: Content Syndication Toolkit <= 1.3 Unauthenticated Server-Side Request Forgery via 'url' Parameter PoC, Patch Analysis & Rule
High CVE-2026-3478 in Content Syndication Toolkit (CVSS 7.2): Content Syndication Toolkit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3570: Smarter Analytics <= 2.0 Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3570 in Smarter Analytics (CVSS 5.3): Smarter Analytics. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3645: Punnel <= 1.3.1 Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-3645 in Punnel Landing Page Builder (CVSS 5.3): Punnel. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-2602: Twentig <= 1.9.7 Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth' PoC, Patch Analysis & Rule
Medium CVE-2026-2602 in Twentig (CVSS 6.4): Twentig. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.0.
March 28, 2026
CVE-2026-3554: Sherk Custom Post Type Displays <= 1.2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3554 in Sherk Custom Post Type Displays (CVSS 6.4): Sherk Custom Post Type Displays. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1891: Simple Football Scoreboard <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1891 in Simple Football Score Board (CVSS 6.4): Simple Football Scoreboard. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-2351: Task Manager <= 3.0.2 Authenticated (Subscriber+) Arbitrary File Read PoC, Patch Analysis & Rule
Medium CVE-2026-2351 in Task Manager (CVSS 6.5): Task Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1911: Twitter Feeds <= 1.0.0 Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1911 in Twitter Feeds (CVSS 6.4): Twitter Feeds. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1908: Integration with Hubspot Forms <= 1.2.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1908 in Integration With Hubspot Forms (CVSS 6.4): Integration with Hubspot Forms. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-4127: Speedup Optimization <= 1.5.9 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-4127 in Speedup Optimization (CVSS 4.3): Speedup Optimization. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-4004: Task Manager <= 3.0.2 Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4004 in Task Manager (CVSS 6.5): Task Manager. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-4143: Neos Connector for Fakturama <= 0.0.14 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-4143 in Neos Connector For Fakturama (CVSS 4.3): Neos Connector for Fakturama. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.