AI-Powered CVE Analysis for WordPress Plugins
We use AI to automate the differential analysis between vulnerable and patched plugin versions to understand and interpret the security issues. What we share here is research-grade proof of concept demonstrations that are then fed back into our endpoint firewall service.
WordPress Proof of Concepts
AI-assisted vulnerability analysis with PoC demonstration
March 24, 2026
CVE-2026-1378: WP Posts Re-order <= 1.0 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1378 in Wp Posts Re Order (CVSS 4.3): WP Posts Re-order. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 24, 2026
CVE-2026-1575: Schema Shortcode <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-1575 in Schema Shortcode (CVSS 6.4): Schema Shortcode. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 24, 2026
CVE-2026-1392: SR WP Minify HTML <= 2.1 Cross-Site Request Forgery to Settings Update PoC, Patch Analysis & Rule
Medium CVE-2026-1392 in Sr Wp Minify Html (CVSS 4.3): SR WP Minify HTML. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 24, 2026
CVE-2026-1397: PQ Addons – Creative Elementor Widgets <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes PoC, Patch Analysis & Rule
Medium CVE-2026-1397 in Peacefulqode Elementzplus Widgets (CVSS 6.4): PQ Addons – Creative Elementor Widgets. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 24, 2026
CVE-2026-1647: Comment Genius <= 1.2.5 Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] PoC, Patch Analysis & Rule
Medium CVE-2026-1647 in Comment Genius (CVSS 6.1): Comment Genius. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 24, 2026
CVE-2026-1854: Post Flagger <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1854 in Post Flagger (CVSS 6.4): Post Flagger. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-13910: WP-WebAuthn <= 1.3.4 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
Medium CVE-2025-13910 in Wp Webauthn (CVSS 6.1): WP-WebAuthn. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-2290: Post Affiliate Pro <= 1.28.0 Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field PoC, Patch Analysis & Rule
Medium CVE-2026-2290 in Postaffiliatepro (CVSS 6.5): Post Affiliate Pro. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-0609: Logo Slider <= 4.9.0 Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode PoC, Patch Analysis & Rule
Medium CVE-2026-0609 in Logo Slider Wp (CVSS 6.4): Logo Slider. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-1247: Survey <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings PoC, Patch Analysis & Rule
Medium CVE-2026-1247 in Survey (CVSS 4.4): Survey. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-1275: Multi Post Carousel by Category <= 1.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1275 in Multi Post Carousel (CVSS 6.4): Multi Post Carousel by Category. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-1278: Mandatory Field <= 1.6.8 Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields PoC, Patch Analysis & Rule
Medium CVE-2026-1278 in Mandatory Fields (CVSS 4.4): Mandatory Field. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-1093: WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute PoC, Patch Analysis & Rule
Medium CVE-2026-1093 in Wpfaqblock (CVSS 6.4): WPFAQBlock– FAQ & Accordion Plugin For Gutenberg. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2025-14078: PAYGENT for WooCommerce <= 2.4.6 Missing Authorization to Unauthenticated Payment Callback Manipulation PoC, Patch Analysis & Rule
Medium CVE-2025-14078 in Woocommerce For Paygent Payment Main (CVSS 5.3): PAYGENT for WooCommerce. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.4.7.
March 23, 2026
CVE-2026-0725: Integrate Dynamics 365 CRM <= 1.1.1 Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration PoC, Patch Analysis & Rule
Medium CVE-2026-0725 in Integrate Dynamics 365 Crm (CVSS 4.4): Integrate Dynamics 365 CRM. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.2.
March 23, 2026
CVE-2026-24589: Cargus <= 1.5.8 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2026-24589 in Cargus (CVSS 5.3): Cargus. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage.
March 23, 2026
CVE-2026-0808: Spin Wheel <= 2.1.0 Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter PoC, Patch Analysis & Rule
Medium CVE-2026-0808 in Spin Wheel (CVSS 5.3): Spin Wheel. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 2.1.1.
March 23, 2026
CVE-2025-12129: CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 Unauthenticated Information Exposure PoC, Patch Analysis & Rule
Medium CVE-2025-12129 in Cubewp Framework (CVSS 5.3): CubeWP – All-in-One Dynamic Content Framework. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.1.28.
March 23, 2026
CVE-2025-12168: Phrase TMS Integration for WordPress <= 4.7.5 Missing Authorization to Authenticated (Subscriber+) Log Deletion PoC, Patch Analysis & Rule
Medium CVE-2025-12168 in Memsource Connector (CVSS 4.3): Phrase TMS Integration for WordPress. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 4.7.6.
March 23, 2026
CVE-2025-14029: Community Events <= 1.5.6 Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter PoC, Patch Analysis & Rule
Medium CVE-2025-14029 in Community Events (CVSS 5.3): Community Events. Atomic Edge summarizes impact, exploitability, and patch details, with WAF rule coverage. Update to 1.5.7.
How Atomic Edge Works
Simple Setup. Powerful Security.
Atomic Edge acts as a security layer between your website & the internet — inspecting, filtering, and blocking malicious traffic before it ever reaches
your application.