AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 26, 2026
CVE-2026-3830: Product Filter for WooCommerce by WBW < 3.1.3 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-3830 in Woo Product Filter (CVSS 7.5): Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQL Injection. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.1.3.
April 26, 2026
CVE-2026-39531: WP Directory Kit <= 1.5.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39531 in Wpdirectorykit (CVSS 7.5): WP Directory Kit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.1.
April 26, 2026
CVE-2026-6370: Mini Ajax Cart for WooCommerce <= 1.3.4 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-6370 in Mini Ajax Woo Cart (CVSS 6.4): Mini Ajax Cart for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2025-15441: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2025-15441 in Form Maker (CVSS 7.5): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated.... Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.15.38.
April 26, 2026
CVE-2026-39511: WP Photo Album Plus <= 9.1.08.001 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39511 in Wp Photo Album Plus (CVSS 7.5): WP Photo Album Plus. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2026-39468: Meta Box <= 5.11.1 Authenticated (Contributor+) Arbitrary File Deletion PoC, Patch Analysis & Rule
High CVE-2026-39468 in Meta Box (CVSS 8.1): Meta Box. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.11.2.
April 26, 2026
CVE-2026-39525: Booking Activities <= 1.16.48.1 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-39525 in Booking Activities (CVSS 5.3): Booking Activities. Atomic Edge summarizes impact, exploitability, and patch details. Update to 1.17.0.
April 26, 2026
CVE-2026-39494: Product Filter for WooCommerce by WBW <= 3.1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39494 in Woo Product Filter (CVSS 7.5): Product Filter for WooCommerce by WBW. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.1.3.
April 26, 2026
CVE-2026-39491: Jupiter X Core <= 4.14.1 Authenticated (Subscriber+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2026-39491 in Jupiterx Core (CVSS 6.4): Jupiter X Core. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 26, 2026
CVE-2026-39474: Post Duplicator <= 3.0.10 Authenticated (Contributor+) PHP Object Injection PoC, Patch Analysis & Rule
High CVE-2026-39474 in Post Duplicator (CVSS 7.5): Post Duplicator. Atomic Edge summarizes impact, exploitability, and patch details. Update to 3.0.11.
April 26, 2026
CVE-2024-49242: Digital Lottery <= 3.0.5 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2024-49242 in Digital Lottery (CVSS 9.8): Digital Lottery. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 25, 2026
CVE-2026-5721: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import PoC, Patch Analysis & Rule
Medium CVE-2026-5721 in Wpdatatables (CVSS 4.7): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.5.0.5.
April 25, 2026
CVE-2024-31115: Chauffeur Taxi Booking System for WordPress <= 7.2 Unauthenticated Arbitrary File Upload PoC, Patch Analysis & Rule
Critical CVE-2024-31115 in Chauffeur Booking System (CVSS 10.0): Chauffeur Taxi Booking System for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 25, 2026
CVE-2024-32692: Chauffeur Taxi Booking System for WordPress <= 6.9 Authentication Bypass PoC, Patch Analysis & Rule
Critical CVE-2024-32692 in Chauffeur Booking System (CVSS 9.1): Chauffeur Taxi Booking System for WordPress. Atomic Edge summarizes impact, exploitability, and patch details.
April 25, 2026
CVE-2025-1564: SetSail Membership <= 1.0.3 Authentication Bypass via Account Takeover PoC, Patch Analysis & Rule
Critical CVE-2025-1564 in Setsail Membership (CVSS 9.8): SetSail Membership. Atomic Edge summarizes impact, exploitability, and patch details.
April 25, 2026
CVE-2025-5955: Service Finder SMS System <= 2.0.0 Authentication Bypass PoC, Patch Analysis & Rule
High CVE-2025-5955 in Aone Sms (CVSS 8.1): Service Finder SMS System. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 24, 2026
CVE-2026-4139: mCatFilter <= 0.5.2 Cross-Site Request Forgery via compute_post() Function PoC, Patch Analysis & Rule
Medium CVE-2026-4139 in Mcatfilter (CVSS 4.3): mCatFilter. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 24, 2026
CVE-2026-4082: ER Swiffy Insert <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-4082 in Er Swiffy Insert (CVSS 6.4): ER Swiffy Insert. Atomic Edge summarizes impact, exploitability, and patch details.
April 24, 2026
CVE-2026-4125: WPMK Block <= 1.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-4125 in Wpmk Block (CVSS 6.4): WPMK Block. Atomic Edge summarizes impact, exploitability, and patch details.
April 24, 2026
CVE-2026-4138: DX Unanswered Comments <= 1.7 Cross-Site Request Forgery via Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-4138 in Dx Unanswered Comments (CVSS 4.3): DX Unanswered Comments. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.8.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.