AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 28, 2026
CVE-2026-4069: Alfie – Feed Plugin <= 1.2.1 Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4069 in Alfie The Productfeedtool Wp Plugin (CVSS 6.1): Alfie – Feed Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1889: Outgrow <= 2.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1889 in Outgrow (CVSS 6.4): Outgrow. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-4072: WordPress PayPal Donation <= 1.01 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4072 in Wordpress Paypal Donation (CVSS 6.4): WordPress PayPal Donation. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3997: Text Toggle <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3997 in Text Toggle (CVSS 6.4): Text Toggle. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3996: WP Games Embed <= 0.1beta Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-3996 in Wp Games Embed (CVSS 6.4): WP Games Embed. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3617: Paypal Shortcodes <= 0.3 Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-3617 in Paypal Shortcodes (CVSS 6.4): Paypal Shortcodes. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3619: Sheets2Table <= 0.4.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-3619 in Sheets2table (CVSS 6.4): Sheets2Table. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3651: Build App Online <= 1.0.23 Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-3651 in Build App Online (CVSS 5.3): Build App Online. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-2294: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-2294 in Uipress Lite (CVSS 4.3): UiPress lite | Effortless custom dashboards, admin themes and pages. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1914: FuseDesk <= 6.8 Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1914 in Fusedesk (CVSS 6.4): FuseDesk. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 6.8.1.
March 28, 2026
CVE-2026-3354: Wikilookup <= 1.1.5 Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-3354 in Wikilookup (CVSS 4.4): Wikilookup. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1648: Performance Monitor <= 1.0.6 Unauthenticated Server-Side Request Forgery via 'url' Parameter PoC, Patch Analysis & Rule
High CVE-2026-1648 in Performance Monitor (CVSS 7.2): Performance Monitor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1886: Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1886 in Go Night Pro (CVSS 6.4): Go Night Pro | WordPress Dark Mode Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3353: Comment SPAM Wiper <= 1.2.1 Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting PoC, Patch Analysis & Rule
Medium CVE-2026-3353 in Comment Spam Wiper (CVSS 4.4): Comment SPAM Wiper. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3641: Appmax <= 1.0.3 Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint PoC, Patch Analysis & Rule
Medium CVE-2026-3641 in Appmax (CVSS 5.3): Appmax. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3460: REST API TO MiniProgram <= 5.1.2 Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3460 in Rest Api To Miniprogram (CVSS 5.3): REST API TO MiniProgram. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3347: Multi Functional Flexi Lightbox <= 1.2 Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-3347 in Multi Functional Flexi Lightbox (CVSS 5.5): Multi Functional Flexi Lightbox. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3331: Lobot Slider Administrator <= 0.6.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-3331 in Lobot Slider Administrator (CVSS 4.3): Lobot Slider Administrator. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-3332: Xhanch My Advanced Settings <= 1.1.2 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-3332 in Xhanch My Advanced Settings (CVSS 4.3): Xhanch - My Advanced Settings. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 28, 2026
CVE-2026-1899: Any Post Slider <= 1.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1899 in Any Post Slider (CVSS 6.4): Any Post Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.