AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
April 19, 2026
CVE-2026-39534: WP Directory Kit <= 1.5.0 Missing Authorization PoC, Patch Analysis & Rule
Medium CVE-2026-39534 in Wpdirectorykit (CVSS 5.3): WP Directory Kit. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 19, 2026
CVE-2025-15611: Popup Box – Create Countdown, Coupon, Video, Contact Form Popups < 5.5.0 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
High CVE-2025-15611 in Ays Popup Box (CVSS 7.2): Popup Box – Create Countdown, Coupon, Video, Contact Form Popups < 5.5.0 - Unauthenticated Stored.... Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.5.0.
April 19, 2026
CVE-2026-3568: MStore API <= 4.18.3 Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update PoC, Patch Analysis & Rule
Medium CVE-2026-3568 in Mstore Api (CVSS 4.3): MStore API. Atomic Edge summarizes impact, exploitability, and patch details. Update to 4.18.4.
April 19, 2026
CVE-2026-39492: WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39492 in Wp Google Map Plugin (CVSS 7.5): WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
April 19, 2026
CVE-2026-39493: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39493 in Simply Schedule Appointments (CVSS 7.5): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
April 19, 2026
CVE-2026-39533: AWP Classifieds <= 4.4.4 Missing Authorization PoC, Patch Analysis & Rule
High CVE-2026-39533 in Another Wordpress Classifieds Plugin (CVSS 7.5): AWP Classifieds. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.4.5.
April 19, 2026
CVE-2026-4429: OSM <= 6.1.15 Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-4429 in Osm (CVSS 6.4): OSM. Atomic Edge summarizes impact, exploitability, and patch details. Update to 6.1.16.
April 19, 2026
CVE-2026-4079: SQL Chart Builder < 2.3.8 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-4079 in Sql Chart Builder (CVSS 7.5): SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.3.8.
April 19, 2026
CVE-2026-4124: Ziggeo <= 3.1.1 Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action PoC, Patch Analysis & Rule
Medium CVE-2026-4124 in Ziggeo (CVSS 5.4): Ziggeo. Atomic Edge summarizes impact, exploitability, and patch details.
April 19, 2026
CVE-2026-3005: List category posts <= 0.94.0 Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-3005 in List Category Posts (CVSS 6.4): List category posts. Atomic Edge summarizes impact, exploitability, and patch details. Update to 0.95.0.
April 19, 2026
CVE-2026-4326: Vertex Addons for Elementor <= 1.6.4 Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins' PoC, Patch Analysis & Rule
High CVE-2026-4326 in Addons For Elementor Builder (CVSS 8.8): Vertex Addons for Elementor. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.7.0.
April 19, 2026
CVE-2026-39587: WP BASE Booking of Appointments, Services and Events <= 5.9.0 Unauthenticated Privilege Escalation PoC, Patch Analysis & Rule
Critical CVE-2026-39587 in Wp Base Booking Of Appointments Services And Events (CVSS 9.8): WP BASE Booking of Appointments, Services and Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage...
April 19, 2026
CVE-2026-39591: WP-BusinessDirectory – Business directory plugin for WordPress <= 4.0.0 Authenticated (Subscriber+) Arbitrary File Upload PoC, Patch Analysis & Rule
High CVE-2026-39591 in Wp Businessdirectory (CVSS 8.8): WP-BusinessDirectory – Business directory plugin for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 19, 2026
CVE-2026-39519: GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
High CVE-2026-39519 in Geeky Bot (CVSS 7.5): GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.2.1.
April 18, 2026
CVE-2026-5226: Optimole <= 4.2.3 Reflected Cross-Site Scripting via Page Profiler URL PoC, Patch Analysis & Rule
Medium CVE-2026-5226 in Optimole Wp (CVSS 6.1): Optimole. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.2.4.
April 18, 2026
CVE-2026-4162: Gravity SMTP <= 2.1.4 Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall PoC, Patch Analysis & Rule
High CVE-2026-4162 in Gravitysmtp (CVSS 7.1): Gravity SMTP. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
April 18, 2026
CVE-2026-1924: Aruba HiSpeed Cache <= 3.0.4 Cross-Site Request Forgery to Plugin Settings Reset PoC, Patch Analysis & Rule
Medium CVE-2026-1924 in Aruba Hispeed Cache (CVSS 4.3): Aruba HiSpeed Cache. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.0.5.
April 18, 2026
CVE-2026-4664: Customer Reviews for WooCommerce <= 5.103.0 Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4664 in Customer Reviews Woocommerce (CVSS 5.3): Customer Reviews for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details. Update to 5.104.0.
April 18, 2026
CVE-2026-4305: Royal WordPress Backup & Restore Plugin <= 1.0.16 Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-4305 in Royal Backup Reset (CVSS 6.1): Royal WordPress Backup & Restore Plugin. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.0.17.
April 18, 2026
CVE-2026-3360: Tutor LMS <= 3.9.7 Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter PoC, Patch Analysis & Rule
High CVE-2026-3360 in Tutor (CVSS 7.5): Tutor LMS. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 3.9.8.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.